Hacker News Reader

And Jeremiah Grossman was talking about it a decade ago. It's amazing these problems persist.

haha, I guess I also reinvented the wheel a few months later :)

Also, malicious scripts can change the password input type field to a regular text field and grab it from there.

There's no need to convert the input type to get the plain text value of a password input. It just masks the input value visually.