Found in #IRC:
"apparently people are getting around Chrome and Firefox telling everyone that non-HTTPS password fields are 'not secure' by just using regular text fields. they change the font on the text field to 'text-security-disc', which is apparently a font that exists of all bullets and looks just like traditional password fields."
How about instead of investing time and effort into schemes like these, you just ROLL OUT #HTTPS FOR FSCK'S SAKE!