Privacy By Default TTY is the discipline of securing terminal input and output so sensitive data never leaves the boundary it was meant for. In interactive shells, REPLs, and automated scripts, the TTY can become a source of exposure—printing authentication tokens, session IDs, or system paths. Once they appear, logs, scrollback buffers, or stdout redirection can store them. The fix is simple in principle, hard in practice: design every tool so that private data never reaches where it can be read by unintended eyes.
The core approach is to treat your TTY as a protected channel.
- Mask sensitive input at capture.
- Suppress output for secrets by default, not as a configuration afterthought.
- Apply sandbox policies so even subprocesses can’t echo credentials.
- Disable insecure logging modes where possible.
A secure terminal design starts at the application layer. Use secure APIs for reading from stdin that do not echo. Enforce environment sanitation before spawning shells. Respect stty -echo and equivalent settings, but go further—strip output lines in pipelines if they contain key patterns. Test it under real-world pressure: unexpected signals, broken pipes, and concurrent writes.