Why can I see password prompts through redirecting output?

Solution 1:

ssh opens /dev/tty for read and write to prompt for the password.

I guess this a security feature, the input has to be from the tty rather than stdin.

If you run strace ssh <host> strace will show you the system calls the command is making.

I get:

open("/dev/tty", O_RDWR|O_LARGEFILE)    = 4
...
write(4, "dave@host"..., 16dave's password: ) = 16
read(4,