Handle the atKeys passPhrase securely

[sitaram-kalluri]

Is your feature request related to a problem? Please describe.

Currently, the "at_activate" function in at_onboarding_cli accepts the passPhrase as an argument. This poses a security risk because the passPhrase becomes visible and is stored in the command history.

Describe the solution you'd like

To securely handle the passPhrase:

For interactive session:

• Prompt the user to enter the passPhrase instead of passing it as an argument.
• Mask the passPhrase input by displaying "*" characters, rather than the actual characters typed.
• Request confirmation of the passPhrase to ensure accuracy before proceeding.

For headless

• Set the passPhrase in the environment variables and pick the passPhrase from the environment variables.

Use TTY to determine if the application is running interactively or running in a headless mode.

[sitaram-kalluri]

Below are the approaches to read the passphrase from the command prompt:

1. Read Silently:
   In this method, the input is read silently, and the characters entered are not displayed on the terminal.

#!/bin/bash

echo -n "Enter passphrase: "
read -s phrase
echo
echo -n "Confirm passphrase: "
read -s confirmPhrase
echo

if [[ $phrase == $confirmPhrase ]]; then
    echo "Passphrase matches"
else
    echo "Passphrases do not match"
fi

echo "Passphrase: $phrase | Confirmed passphrase: $confirmPhrase"

Output:

sitaram@sitaram-ThinkPad-E14:~$ ./silent_read.sh 
Enter passphrase :
Confirm passphrase :
Pass phrase match
passphrase : abcd | Confirm pass phrase: abcd

2. Read Securely:
   In this approach, an asterisk * is displayed for each character entered instead of showing the actual characters. However, this approach has the limitation where the bash script does not recognize the newline character properly, meaning when the enter key is pressed, it counts as a character but does not terminate the input.

#!/bin/bash

echo -n "Enter passphrase: "
stty -echo
pass=""
# read -r to escape the backslash
# read -s to read silently, preventing characters from being displayed on the terminal
# -n1 reads one character at a time
while IFS= read -r -s -n1 char; do
    if [[ $char == '\n' || $char == $'\x0a' || $char == $'\x0d' || $char == $'\u000A' ]]; then
        break
    fi
    pass="$pass$char"
    echo -n "*"
done
stty echo
echo
echo "Entered passphrase: $pass"

Output

sitaram@sitaram-ThinkPad-E14:~$ ./secure_read.sh 
Enter passphrase: **************
sitaram@sitaram-ThinkPad-E14:~$  (Used Ctrl + C to force stop the execution).