[wizofaus]

A password entry control doesn't have to interpret backspace the same way a regular text input control does (obviously meaning you'd need an alternative method of correcting typos). The 08 character can still be part of the control's "text" property that is ultimately hashed/stored etc. As for nulls, languages not based on C handle them fine but you'd have to be very careful they never got passed to an OS-level function, which nearly always treat them as terminators.