People want feedback as they type their passwords, but stringing out the same character allows shoulder surfers to see the *length* of their passwords. An improvement on this process would be to *change* a single character displayed as each character is typed. So instead of

p
*
pa
**
pas
***
pass
****
passw
*****
passwo
******
passwor
*******
password
********

You would instead do
p
+
pa
*
pas
+
pass
*
passw
+
passwo
*
passwor
+
password
*