When creating a VM, the field to supply the root password for the VM is just a regular text field.
This means you either can't create a VM while someone is sitting next to you, or you must accept that the root password may be compromised.
The password field should be treated as such, echoing bullets. In addittion, there should be two password fields, so typos can be caught.
Post is closed for comments.