pass on my machine:
@movq@www.uninformativ.de that’d definitely be an improvement! You’d also want to make sure the password does not end up in shell history, terminal scroll history, etc etc etc, which would probably take a bit more care.
Personally, I’d also want a kind of “This is dangerous; are you really sure you want to do this?” warning that can’t be disabled to show up, just to make sure users are understanding that what they are doing is not good. And perhaps some pointers about safer alternatives to use (for instance, copying password to the clipboard, which is automatically cleared after a short time period, and then having the downstream app/script grab the password from the clipboard. Or sending the password through a local pipe or socket that’s been carefully secured).
This stuff is already leaky because when you use something like pass the cleartext password ends up in the RAM and CPU caches for an unpredictable period of time, and can be sniffed out of there if you know what you’re doing (that’s why things like Yubikeys exist because they don’t do that). Why make it even more leaky and invite user error on top of that when you don’t have to?