[iceman_w]

Insecure websites could get around this by not marking the fields as password fields but using javascript to make them appear so to the user.