Many programs access the terminal driver at a relatively low level when reading passwords, they don't just read STDIN. This is to prevent automated hackers. I don't know if this is the case with your version of these tools, but if you use truss or strace on the all you will see what it is trying to do.