title: Is javascripts access to a password fields value considered a security risk?
body: <p>If it is good style and security to store passwords securely and properly, then shouldn't the same be for web pages that require a user to enter a password?</p>
  
  <p>consider this example</p>
  
  <pre><code>&lt;script&gt;
  
  function copy() {
      var text = document.getElementsById('text');
      var pass = document.getElementsById('pass');
  
      text.value = pass.value;
  }
  
  &lt;/script&gt;
  
  &lt;input type=text id=text&gt;
  &lt;input type=password id=pass&gt;
  
  &lt;button onclick="copy();"&gt;copy&lt;/button&gt;
  </code></pre>
  
  <p>type something into the password box and click the copy button and voila, it is exposed to the world.  However if you copy and paste from the password box then you will get useless data.</p>
  
  <p>Consider the number of pieces of javascript that are included on your login page that are not controlled by you (analytics, pageflow trackers, hosted scripts in the cloud).  Does it make sense for a web browser to prevent this sort of programmatic access to password fields and instead provide it's own password validation API?</p>