content: That would require a fake password field - which should be noticeable (unluckily, on OS X, there are no security measures against this - rather the opposite, even the legitimate password windows look shady edit: and appear at unexpected (and unnecessary) times). Also, even if, I think an app reading all your passwords should have to go through a security message saying what app is trying that, and whether to allow it. With strong warnings if it isn't Keychain Access itself or Safari.