A website I use occasionally has had a recent overhaul and added a "Show" checkbox next to the password field on their login form. I understand why some ppl want these when they're actually typing their password in, but it seems like a security hole if you're using a password manager that fills your password.
In my case, the password is saved in Firefox's password manager which is in turn secured with a master password **. So, yes, someone else using Firefox on my computer temporarily can potentially log in to this site automatically, but I at least expect they can't actually see my current password.
However, with this new check box they can: I visited the site, went to the login form, which Firefox pre-filled with my password (obfuscated as a series of dots). Then I clicked on "Show" and sure enough my password was displayed in plain text.
Finally, if this is a security issue, what's a concise way to outline the problem to the web admin of the site? I'm not a web designer/admin myself.
** For the sake of this thread, let's not go into a big discussion about whether the Firefox password manager is a safe way to secure passwords. I use it only on my home and work computers which are rarely used by others. Also even if you think I should be using a more robust manager like LastPass, I think a similar vulnerability would exist if someone happens to sit at your computer while LastPass is logged in.