Malware on the user's machine could catch the password in either case.