From Neilsen's article: But password masking and Reset buttons are not something users actively seek out. Reset buttons might not be, but password masking sure

From Neilsen's article: But password masking and Reset buttons are not something users actively seek out. Reset buttons might not be, but password masking sure is. There's nothing quite as startling as seeing your password in plaintext. Not having the bullets is just going to make you look insecure, and appearances matter in the psychology of security. You don't want your users feeling insecure. Even if this wasn't a daft idea, he's beginning to contradict himself, anyway: It's therefore worth offering them a checkbox to have their passwords masked contradicts his claim on his "Reset buttons must die" piece: The extra choice requires extra thinking, and the time saved by using an optimal interaction technique is often smaller than the time wasted on having to think instead of just moving ahead with a single interaction technique that is always used. So for all the time you save by seeing your password in the clear, you lose by having to deal with the extra checkbox. Also worth noting: browsers have autofill these days. Just loading a page on one of these browsers would be enough to disclose your passwords. Forget shoulder surfing, just create a diversion, browse to a few sites on the victim's computer, and you've got the lot.