There is an argument in the whole masking argument that doesn't really have anything to do with security- it is that filling out a box and having the characters masked is a well known usability metaphor for users- implying the content should be kept hidden and implying (though it's not always true) that in the backend it is also kept secure. The metaphor comes from ATMs etc. All security aside, when the vast, vast majority of casual computer users finally have a computer metaphor nailed down it's usually very counterproductive to try to change it. Like trying to move the "File" menu to the far right of the menu bar for your next desktop app...