I thought of this approach already. Unfortunately, it requires the wrapper to be cognizant of telnet's output and expect "Password:". Only then can the wrapper safely apply ReadMode settings around the password request. However, since telnet is only opened for writing, the wrapper does not know what telnet outputs and the ReadMode trick can't work. The only way to make that work is if telnet is started with open3 and autoflush is turned on. Even then, I'm not sure if the login "Password:" request would get flushed because it does not contain a new line after it.