[charcircuit]

Shoulder surfing for passwords is a tiny concern compared to how much these measures hurt ux. I am happy that the current trend is now to also let the user toggle off the * to see what you actually typed.

I don't know if these were added but to match security of other graphical password fields after submitting the password the terminal should clear the starts and while the password is being inputted it should protect the window so it can not be screen recorded.

[croes]

With modern technology you don’t actually need to be behind the shoulder to see that information, so that is less security for some convenience.

I don’t think we can afford less security