Since ExpressionEngine 2.5.3 the form used to log into the control panel has autocomplete="off"
set on the password input field. This means that browsers won't offer to remember passwords when they're entered.
When creating new passwords for super-admins I generate a long, unique passwords using Keychain. I'll never remember these, and there's no way my clients will either. Because of this, I always recommend that people have their browsers remember passwords. I believe this is in every way more secure than remembering the password (i.e. writing down on a sticky note somewhere) and entering it (i.e. having it read by a keylogger) every time.
My question is: can the autocomplete="off"
attribute be removed from the password input field somehow?