I suppose you could tell them to go back to a previous version of the browser.

Of course that would be a terrible idea for a number of other reasons, but if enough people specifically avoid more recent versions of Chrome for this reason, maybe Google will finally do what's actually best for users and make this behaviour configurable.

> I suppose you could tell them to go back to a previous version of the browser.

No, you can't do that.

Instead you have to tell them to stop saving passwords in the browser.

> asking for the other user's password

What? Why would the other user ever provide their password to this user?

How about an Administration interface that allows you to set a password to a known value for the user to use so they can log back into their account.

So the helpful support person can now go "Your password is now 'foobar' and you will be asked to pick a new one when you login."

That doesn't sound like a safe way of resetting passwords. You should supply them a token they can use to set their own password. Your employees should not know your users passwords.

The token is the new one-time password that must be reset upon login.

Exactly that. I use this feature as an Admin relatively often in Adobe Analytics. I never am able to know the "real" password a user provides on first login after reset.

A one time password is nothing but a token - maybe not ideally named.

In a corporation, this is totally okay as long as the reset password is safe or the account is locked from external access until the password has been changed.

The employee should of course change their password and that should be enforced policy, the admin shouldn't know user passwords.

Tokens work too but it's a bit of an overhead, especially in smaller SMB where the admin is probably just across the corridor or atleast in the same building.

Why not let the administrative interface generate the temporary password and show it?

Why would you use input type=password for that?

Because it is, in fact, a password.

You're creating a secret token. Both the administrator and the browser should be made aware of this. The administrator, so that they don't send it to the user via an unsecure method (Tweet it publicly), the browser so that it shows warnings if the site is somehow served without ssl or is compromised.

If it's something like a password, it should be treated like a password. Why shouldn't you use type=password for that?