This is not really a N900 issue. Some apps (especially the new ones and those in the devel repos) are not coded properly when it comes to handling passwords (they do not use the proper password handling widget etc.)
So when you see a password dialog that is not replacing the letters of your password with "*" while you are typing them, that means your password will end up in the autocomplete dictionary.
So when you have such a situation, you may delete the password entry using the autocomplete editor and next file a bug report to the developer of the "offending" app.