For all the dancing around with read and cat and heredocs, ultimately command substitution will result in
$(provide_pw) being replaced by the actual password. It will then be part of the process details.
man curl, about
On systems where it works, curl will hide the given option argument from process listings.
So, on such systems, and also on Linux systems with
hidepid set appropriately, the password will be hidden from other users, but elsewhere, everybody can see the password by looking at the command line of the curl process using
If you're willing to
read the password, just have
curl do it for you:
If you simply specify the user name, curl will prompt for a password.
Also see: How does curl protect a password from appearing in ps output? There is a race condition here: between curl starting and getting around to cleaning the command line, the password will be visible, and if it isn't hidden by other means (like
hidepid on Linux), will be visible to everyone during that window.