The pass utility (a password manager which is pretty popular on Debian derivatives) uses two password prompts:

Enter password for [account]: 
Retype password for [account]: 

Comint only detects the first one as a password prompt, but shows the second one in clear. The fix is to add “Retype” to ‘comint-password-prompt-regexp’. “Type” could be a useful addition as well. It would also be nice to add “Master” to that list, so that “Master password:” is recognized as well.

Clément.