Would you mind using getpass if the "octogit login" command is only given one argument? It'd be cool to be able to use it with other people in the room and without leaving it in the shell history. It would also be nice to know where my password is being stored and to have a logout command that securely erases it.
Is it possible to use an oauth-based thing instead? I don't know if github lets you do much with oauth, I'm just a little wary of storing my password in what would presumably be plaintext.
You can just request a token[1] using the GitHub API on first load and then use that. I implemented that recently in Pulley[2], which is a GitHub Pull Request Lander.