Can ads on a page read my password?
Stupid question: why not make password-marked fields something that JS engines simply can't read from? I imagine it would stop you from client-side warnings of password insecurity, but is there a bigger problem?