Reply to thread

This isn't really something we're looking to change at this point, though we did notice a key difference between XF1 and XF2 in that in XF1 the password field was marked as autocomplete="off" so it would at least prevent the password being saved from and recalled for that field for future usage.

There's definitely arguments for changing it, but also arguments against. Ultimately it's a field which is displayed for a mere matter of minutes and it's the kind of thing you're unlikely to be doing with people looking over your shoulder. It's then stored in plain text in your config file where it's just as exposed to some of the similar risks. It's likely not a big deal.