The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but there was one thing that led to great debates:
As part of the password change process for users, the user has to provide the old password as well as the new one two times—nothing unusual. In addition to that the new password has to conform to a password policy (minimum length, yadda yadda).
The application is realized with Vaadin which uses small AJAX messages to update the UI. The whole logic of the application lives on the server. This means that all validation of the password change form happens on the server. In order to validate the form, both the old password as well as the two new passwords (which should match of course) have to be sent to the server. If there is anything wrong (old password is wrong, new passwords don't match, new password doesn't conform to the password policy), the user gets an error. Unfortunately as part of the syncing process Vaadin sends all form data back to the client again—including old and new passwords.
Since all this happens over SSL I never thought twice about it but the security company saw this as a security risk of the highest severity. Note that the issue in the eyes of the security company was not that the data is sent to the server but that the server included the data in its response in case validation failed. So our current solution is to empty all fields if validation fails. This leads to poor user experience as the user has to fill in three text fields again and again if for example the passwords repeatedly don't match the password policy.
Am I being naïve in thinking this is way over the top? I mean, if an attacker breaks the encryption, they have access to the whole traffic anyway.
edit: Regarding shoulder surfing I want to make clear that no password is ever echoed back to the user. All input fields are proper password fields that only show placeholders but no actual characters.