I discovered that there is an undocumented function :io.get_password() that reads input from the shell without echoing it and returns a password. That seems to be what I need (http://erlang.org/pipermail/erlang-questions/2011-November/062798.html)
My code now reads:
username = Mix.Shell.IO.prompt("username:")
IO.write("password: ")
password = :io.get_password()
For others looking to this solution, read the rest of the thread. This was a solution for me in one context, but may not be general purpose solution.
