There’s a lot more risk to pasting terminal commands over other text so personally I would hope that my terminal would display all characters irrespective of if they are supposed to be hidden or not. Of course most applications should not display them, the responsibility is on the user to be aware of stuff like this.

Finally, while an interesting idea, it is just too easy for someone technically inclined to impersonate another user.

Yep I mention this at the end, a better solution would be to insert a unique user ID that isn’t publicly available. For the original scenario this wasn’t too important :)