This raises the interesting question of why we obscure the input when changing passwords. Showing the new password would allow people to check and correct it, so you'd only need one input.
Given that the contents of a password input can easily be revealed, the only security obscuring the input provides is from an attacker who can see the screen but not the keyboard, and has no physical access to the device - a pretty limited threat pool.
I guess the answer is that users expect passwords to be hidden. So we make their lives more difficult purely to keep them happy.
Given that the contents of a password input can easily be revealed, the only security obscuring the input provides is from an attacker who can see the screen but not the keyboard, and has no physical access to the device - a pretty limited threat pool.
I guess the answer is that users expect passwords to be hidden. So we make their lives more difficult purely to keep them happy.