Any operating system-level measure to prevent keyloggers logging secure input fields is bypassed when input masking is disabled in the browser, except where the browser natively provides a Show password feature.
What low level measures? Afaik if you have untrusted software running that can globally listen to your keyboard you're f'ed.
Would be pretty neat if we could establish a trusted path from the keyboard to the server using crypto-magic. Like the keyboard could encrypt using the servers public key or something.
The keyboard itself could encrypt the keystrokes before sending them to the OS? That could work. Moves the threat to attacking the keyboard firmware.
Macs prevent keylogging of designated secure inputs at the BIOS level.