I'm not willing to concede his point yet, but even if he's right, this should be implemented by the browser, not the website. And if you consider taking his advice, I suggest masking the password as soon as the input field loses focus.