The real problem I see is that the majority of users would freak out if their password wasn't masked, as if it's somehow an implication of lax security overall.

The real problem I see is that the majority of users would freak out if their password wasn't masked, as if it's somehow an implication of lax security overall. Users have been trained for the last twenty years to expect that when they type in a password, it'll be masked. Even me: I'm a web developer and if I hit a website where the password was unmasked, I would just assume they had no idea what they were doing.