Add --passwd to support piping password via stdin

[Chouser]

This adds a new command-line flag --passwd that can be set to either "getpass" (current behavior and still default) or "stdin". Specifying "stdin" takes the password straight from stdin without prompting or requiring a tty, and causes prevents any other interactive prompts from happening.

The purpose of this is to allow scripted use of alohomora, where the password is collected from some other programmatic source, such as lpass-cli or similar.

[abrooks]

@Chouser and I discussed this a bit and came to the conclusion that coupling prompt_for_a_thing should actively check (rather than being prefaced by a de-coupled check).

[Chouser]

Updated pull request with @abrooks's suggestion

[skemper]

Since I've been picking up several PRs, and since @abrooks asked, let's talk about this one.

Can you give me a bit more detail on the use case? In general I'm wary of programmatically accepting a password because that means the user has to have the password stored somewhere. While there are users like yourselves who will store those in a password manager and pull them out programmatically, I can also see folks doing things like alias alohomora="echo MYPASS > alohomora" which is... concerning.

Also, while testing this out, I've noticed that it will fail if you have more than one device configured on your 2FA account. This is because alohomora needs to ask you which device to use, which we don't offer an option or config entry for. So we'd need to ponder how to solve that problem as well.

In talking to @gcochard about this, he suggested we might talk about implementing some kind of credential helper instead, where the user could specify a command-line program to be run which would spit the password to its stdout, and could then be collected by alohomora. I'm not familiar enough with lp-cli to know if that would accomplish the same goal, but I have a gut feeling (super scientific, I know) that it would be abused less than piping in? What do you think @abrooks / @Chouser?

[marksidell]

My PR 24 should solve the device prompting problem.

And my two cents: There are lots of ways people can do stupid things with passwords. Accepting the password via stdin may let someone do something stupid, but will make things more secure for those of us who can pipe the password from a password manager. As it is, I'm constantly having to copy/paste the thing from my get-my-password utility, which seems less secure to me.