(and without saving the password to disk or entering it on the commandline, both of which less secure)