html-spec_3.html#SEC20
|The widely deployed methods for submitting forms requests -- HTTP and
|SMTP -- provide little assurance of confidentiality. Information
|providers who request sensitive information via forms -- especially by
|way of the `PASSWORD' type input field -- should be aware and make
|their users aware of the lack of confidentiality.
Dan