We believe that your issue has been closed by the upload of
Version 0.55 of grml-debootstrap from Michael Prokop <mika@grml.org>.
The explanation is attached below

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 04 Feb 2013 15:58:46 +0100
Source: grml-debootstrap
Binary: grml-debootstrap
Architecture: source all
Version: 0.55
Distribution: experimental
Urgency: low
Maintainer: Grml Team <team@grml.org>
Changed-By: Michael Prokop <mika@grml.org>
Description: 
 grml-debootstrap - wrapper around debootstrap for installing pure Debian
Changes: 
 grml-debootstrap (0.55) experimental; urgency=low
 .
   [ Evgeni Golov ]
   * ISO related bugfixes:
     * [6f8ba91] set ISO to file:$ISO, not to file:$1 which is
       just wrong
     * [ab690ec] debootstrap from an ISO when ISO is set as MIRROR
       is always set
     * [10690a9] Debian ISOs do not contain signed Release files
     * [9c1ec11] remove local (file://) mirrors from sources.list
   * Misc improvements:
     - [010a354] add a fallback mirror to be added in case when a local
       mirror is removed
     - [91e39fc] Dynamically determine the correct kernel package name
       [Closes: issue1206]
     - [76ca758] Add firmware-linux-free to the packages to be installed
     - [a9697fb] add BOOT_APPEND to GRUB_CMDLINE_LINUX_DEFAULT
     - [a93156c] don't fail to ask for a password if there is no TTY
       [Closes: issue1200]
 .
   [ Michael Prokop ]
   * [f3a7ab6] Use http.debian.net as default mirror
Checksums-Sha1: 
 f8f88b45e93a74b4be198a13ddc818cc0406b455 1192 grml-debootstrap_0.55.dsc
 4d0922ae7c289746533de71914018642fb9a363a 148418 grml-debootstrap_0.55.tar.gz
 e613c44e8ce82d27267e8fdf3a79bb640f97f6ff 125674 grml-debootstrap_0.55_all.deb
Checksums-Sha256: 
 fd9c904891b1b83df918a9f6bb1619f946c9d21b1e94b9c83793c9599e082d8a 1192 grml-debootstrap_0.55.dsc
 160339f4de37022be57a2408d5ee47e2fef92a852cad79adee853208f79f91e8 148418 grml-debootstrap_0.55.tar.gz
 e723dc6a11d1b4fba3d50f8489a8f8d043dd136496bcb09f3293167e4b398732 125674 grml-debootstrap_0.55_all.deb
Files: 
 0d6fd989d3e2639668e6e90d2c55ff85 1192 admin optional grml-debootstrap_0.55.dsc
 110685e3cbddccf21df388d7324c1e8b 148418 admin optional grml-debootstrap_0.55.tar.gz
 3da320873304455bc7d56e0cb3397716 125674 admin optional grml-debootstrap_0.55_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlEP1oIACgkQ2N9T+zficugirACfeazrfxweuYnxsfrlImUZfhNw
Y4UAnj5v3w06tZALOzawxynd9VhisVgs
=kyRg
-----END PGP SIGNATURE-----

Thanks for the fix, applied in grml-debootstrap master, this bug report will be 
marked as resolved once the according upload took place.

proposed fix:
 https://github.com/evgeni/grml-debootstrap/commit/3947a98b7afe13daa3817183ad3af40e8f807a0d

Mhh, bash's read -s does exactly this: it does not protect the input when no TTY 
is available (-s stands for silent, not secure, heh).

verified. you can reproduce this with this simple script:

--<--
#!/bin/sh

askpass() {
  # read -s emulation for dash. result is in $resp.
  set -o noglob
  stty -echo
  read resp
  stty echo
  set +o noglob
}

echo -n "Enter new Windows password for user root: "
askpass
echo
echo "You entered $resp"
-->--

The problem is that calling ssh foo@bar cmd won't allocate a TTY and calling stty without a TTY is 
kinda... stupid.

You can workaround this by calling ssh -t foo@bar cmd.

Not sure how we would fix that properly. Not calling stty in the case there is no TTY would reveal 
your password (try `ssh ... passwd`). We could check for a TTY and error out early.

I received the following bugreport:

If grml-debootstrap is invoked through ssh like:

  ssh root@grml grml-debootstrap ...

then the prompt for setting the password doesn't work.