fix(registry): Prompt for password without echoing it to terminal

cmd/registry.go

@@ -2,11 +2,13 @@ package cmd
 
 import (
 	"fmt"
+	"syscall"
 
 	"github.com/qri-io/ioes"
 	"github.com/qri-io/qri/lib"
 	"github.com/qri-io/qri/registry"
 	"github.com/spf13/cobra"
+	"golang.org/x/crypto/ssh/terminal"
 )
 
 // NewRegistryCommand creates a `qri registry` subcommand for working with the
@@ -128,9 +130,7 @@ dataset on a registry.`,
 	}
 
 	signup.Flags().StringVar(&o.Username, "username", "", "desired username")
-	signup.Flags().StringVar(&o.Password, "password", "", "a new password for online login")
 	signup.Flags().StringVar(&o.Email, "email", "", "your email address")
-	signup.MarkFlagRequired("password")
 	signup.MarkFlagRequired("username")
 	signup.MarkFlagRequired("email")
 
@@ -157,8 +157,6 @@ A repo can only be associated with one registry profile.`,
 	}
 
 	prove.Flags().StringVar(&o.Username, "username", "", "your existing registry username")
-	prove.Flags().StringVar(&o.Password, "password", "", "your registry password")
-	prove.MarkFlagRequired("password")
 	prove.MarkFlagRequired("username")
 
 	// TODO (b5) - restore publish & unpublish commands
@@ -187,10 +185,14 @@ func (o *RegistryOptions) Complete(f Factory, args []string) (err error) {
 
 // Signup registers a handle with the registry
 func (o *RegistryOptions) Signup() error {
+	password, err := o.PromptForPassword()
+	if err != nil {
+		return err
+	}
 	p := &registry.Profile{
 		Username: o.Username,
 		Email:    o.Email,
-		Password: o.Password,
+		Password: password,
 	}
 	var ok bool
 	if err := o.RegistryClientMethods.CreateProfile(p, &ok); err != nil {
@@ -201,9 +203,13 @@ func (o *RegistryOptions) Signup() error {
 
 // Prove associates a keypair with an account
 func (o *RegistryOptions) Prove() error {
+	password, err := o.PromptForPassword()
+	if err != nil {
+		return err
+	}
 	p := &registry.Profile{
 		Username: o.Username,
-		Password: o.Password,
+		Password: password,
 	}
 	var ok bool
 	if err := o.RegistryClientMethods.ProveProfileKey(p, &ok); err != nil {
@@ -213,6 +219,17 @@ func (o *RegistryOptions) Prove() error {
 	return nil
 }
 
+// PromptForPassword will prompt the user for a password without echoing it to the screen
+func (o *RegistryOptions) PromptForPassword() (string, error) {
+	fmt.Print("password: ")
+	bytePassword, err := terminal.ReadPassword(int(syscall.Stdin))
+	fmt.Print("\n")
+	if err != nil {
+		return "", err
+	}
+	return string(bytePassword), nil
+}
+
 // // Publish executes the publish command
 // func (o *RegistryOptions) Publish() error {
 // 	var res bool