Whilst I agree that customs and general practice should be challenged wherever necessary, there is a point where common sense needs to prevail. I have, on one or two occasions had my password “unmasked” by an app, and that bothered me and made me more tense about using the site than anything else.

I think it’s also somewhat churlish to suggest that password masking is a net only thing. The most obvious use of this practice is at an ATM machine, something that has been standard since they were introduced. Like on a computer, many times no-one will be watching, but it’s nice to know your code is covered from any other stray prying eyes. This is the convention that was carried onto the web because it made sense, so it isn’t a case of challenging a “status quo” as Paul mentions in his podcast. Imagine if all of a sudden the banks said they were dropping masked PIN numbers (or giving it as an option) because it would reduce mistakes and make customers feel more confident putting their details in!