Sure, it's vulnerable to the man behind your back. But if such threat exists, you shouldn't type your password anyway.