Not sure if this can be answered at all, as it's a rather borad field and calling for opinions rather than anything solid.

Oh, and don't forget, there is also a middle field: Hardware that provided feedback due cursor positioning/movement in fieds with an invisible attribute. Something common on mainframes with block mode terminals. Here everything worked as expected, except that the caracters where not displayed. So editing was possible (and needed as it was local), and managable, even without replacement chars.

And before that, a mainframe with a line printer interface with half duplex communications (local echo that couldn't be disabled), would print out a bunch of ######## cr xxxxxxxx cr %%%%%%%% cr ********, overtyping each set, and then let you type your password into the resulting black smear on the paper.

@Raffzahn Usually, when new features are introduced, there are publications justifying them. The question can be narrowed by only considering the case of displayed masking characters as opposed to an invisible attribute on block mode terminals, which are akin to suppressing echo on serial terminals - the best a block mode terminal could do.

@GregHewgill Cool! What system did that? Not UNIX, for sure.

@LeoB.: Unfortunately, I don't recall exactly. I was pretty young at the time! It may have been an IBM mainframe. But I'm pretty sure it only did that if it knew it couldn't turn off the local echo.

Not realy Leo, as invisible fields still do (and show) cursor movement. Supressing echo shows nothing. Ando , Features like that wheren't acomplished by huge PR back then. Why bother to write papers when adding such a feature to your application?

@Raffzahn I got that, don't doubt. But counting movement or blank space is much harder than counting clearly displayed characters. -- That's why I'm asking about standard system programs, like login, as opposed to applications.

@Greg Although there are "masking characters" in your example, the method is more like turning off echo or using an invisible field, as the length of the black smear does not depend on the length of the actual password.

@LeoB. Ermm, you're forgeting, that most logins wheren'd form some shell programs or alike - at least not in the good old days. Usually users connectes to their company applications. Having a system login and woring in a seperate space was some luxury for developers. Unless ofc they still prefered punch cards :)) Still in the late 70s, having a system login was rather rare and largely restricted to universities and alike. By far outnumbered by direct users of commercial applications. So password handling was largely an application issue, not a system issue.

@Raffzahn Then consider my question limited to systems with system logins OR those providing a system call of a sort to switch terminals to the "password entry" mode, that provided visual feedback for passwords. After many years of UNIX using no echo for the text mode password entry, where does the fashion of using visual feedback in GUI logins come from?

@LeoB. This now sounds like you tailor the question to get an answer you already have, instead of looking for a real one, doesn't it?

@Raffzahn I don't have an answer. I don't believe that MS-DOS had any influence on UNIX. My mention of MS-DOS was just an example. After all, it doesn't have any system programming interface for logins or password entry.

I don't think showing the number of characters entered on a video display terminal would have been considered a security weakness, since someone who could see that would usually be able to hear the keyboard. Printing terminals were a bigger issue. I find it interesting that pre-printing with X's seemed to be considered adequate for those since in many cases someone who took any significant effort would be able to make out what characters were overprinted. I also find it interesting that no applications that did echo periods would pad out the line to a fixed length after the user hit enter.

My favorite "masking characters" story, however, relates to the Beta Brite display, which uses a fixed-length six character password which is echoed on screen as asterisks, but that display also has a back-door password of ****** [six asterisks]. So by masking the primary password it shows the back-door password!

@supercat That's crazy! And what would a terminal need a password for?

When does a default install of MSDOS ask you for any password AT ALL?

@LeoB.: One would enter a password on a video display terminal as a means of logging onto the system to which it is connected. And the Beta Brite display as a scrolling message marquee that was configurable via wireless keypad, so in the absence of the back-door, the password would guard against pranksters reconfiguring the signs in shop windows, etc. But since the backdoor is in the manual, anyone with a remote would have the backdoor password making the primary one useless. But showing the backdoor password when the primary one is entered is still IMHO a classic.

@supercat A classic for sure. Reminds me of telling the password when prompting for it in Tolkien's "Speak, friend, and enter."

Why is simple, so people can’t steal other people’s passwords.

@SolarMike The context was "as opposed to turning off echo completely".

@LeoB. Not in the title it doesn’t....

@SolarMike That will teach you to read questions completely.

Perhaps you might improve your writing .. or then again...