You could do that. As you type into any <input type="password"> the browser would buffer the text and not send it through to the DOM immediately. When you hit

You could do that. As you type into any <input type="password"> the browser would buffer the text and not send it through to the DOM immediately. When you hit enter, leave the field, submit the form, etc then it'd get sent through to the DOM where it'd be available to (potentially malicious) javascript. While the password is in the buffer the browser could check for "non-throwaway password + http" and block it if need be. This does require the browser to know which passwords are which, though, at which point it might as well be entering them for you (and only being willing to do that over https).