Ebay posts every character a user types into the password box
I reproduced it for fun with BugReplay, the site I've been working on for the past year: <a href="https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-aa0f-8f5503d9c663" rel="nofollow">https://app.bugreplay.com/shared/report/3efa632d-5b51-45f1-a...</a>
Checks out, password is in the GET param.