We had password echo enabled for CfM for some time (tracked in issue 238290). The infra code still present so we can just re-wire it with Touchview mode.

Sounds good. I assume we'll need some sort of broadcast mechanism to update the state of any active password fields as the device shifts in/out of touchview?

Yes. We need some infra code change to enable/disable password echo dynamically. Currently, it is initialized during renderer and Textfield initialization.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a34e954cec188f2cc09270ef801dd35ecd1072ac

commit a34e954cec188f2cc09270ef801dd35ecd1072ac
Author: xiyuan <xiyuan@chromium.org>
Date: Fri Aug 26 21:29:41 2016

views: Textfield gets password reveal duration from ViewsDelegate

Remove password_reveal_duration_ member in Textfield and always
gets it from ViewsDelegate.

BUG=634472
TEST=TextfieldTest.SetPasswordRevealDuration

Review-Url: https://codereview.chromium.org/2286433002
Cr-Commit-Position: refs/heads/master@{#414811}

[modify] https://crrev.com/a34e954cec188f2cc09270ef801dd35ecd1072ac/ui/views/controls/textfield/textfield.cc
[modify] https://crrev.com/a34e954cec188f2cc09270ef801dd35ecd1072ac/ui/views/controls/textfield/textfield.h
[modify] https://crrev.com/a34e954cec188f2cc09270ef801dd35ecd1072ac/ui/views/views_delegate.cc
[modify] https://crrev.com/a34e954cec188f2cc09270ef801dd35ecd1072ac/ui/views/views_delegate.h

kuscher@, sky raised a point during the review that whether we want to enable the feature when user is using touch (e.g. the last pointer event is touch) and maybe even do it for desktop. UX inputs/thoughts on this are appreciated.

I'd prefer to only do it for touch (Virtual Keyboard) as we might get into a situation where a teacher for example logs into a website while presenting only to have the whole class memorize his/her password.

Kuscher, thoughts?

The teacher/presentation/in-a-public-place story is pretty significant. I would strongly prefer a system that allowed the user to actively control the password-reveal.

Many password ui's show an eyeball icon to show/hide the password. For system-controlled interfaces (like system login) we could use a similar mechanism. This wouldn't work for web content though.

Perhaps we could move the show/hide control into the vk? This would provide a consistent and universal control for showing the password.