It depends on what you're doing, to. For passwords, /dev/tty is almost always best. If you have reason to expect that someone might want to redirect the user's input for some reason, stderr would be a better choice. But also consider that someone might want to capture a fatal error from stderr (not all programs are well behaved, and in particular ghc's runtime panics would still go to stderr ignoring brick; also consider any FFI callouts to C that might assume stderr is a dedicated error channel) which would again suggest /dev/tty. There's no one right answer here, in short.