[matthewmacleod]

I don't believe this is entirely accurate – a further auth prompt is always required before revealing plain-text passwords.