On: CSS Based Attack fontface

[blowski]

> considering the browser is not rendering the actual characters for password fields

Unless you've got a 'show password' checkbox (as recommended by Jakob Nielsen - http://www.nngroup.com/articles/stop-password-masking/).

[grub5000 → blowski]

Any info on whether the new IE/Edge click-to-show password button exposes this vector?

[lepunk → grub5000]

tried, but it doesn't seem to do