Justin is right. This is why the browser I'm working on flashes your passwords in plaintext ever few seconds. Let's not pretend an attacker couldn't look over your shoulder anyhow.