If you're on a unix-derived system, you can turn off console echoing with system "stty", "-echo";, then read the string with <STDIN>=~/(.*)/ and $password= $1;, (this chops off newline, don't forget to do that) then turn back echoing with system "stty", "sane";. This won't print asterisks, however.

Pity there's no &POSIX::getpass.