[bored]

Also, malicious scripts can change the password input type field to a regular text field and grab it from there.

[talmand]

There's no need to convert the input type to get the plain text value of a password input. It just masks the input value visually.