>> 1.) typing it out manually while you can't see if you made a mistake
This is my pet peeve. Password fields should not be obfuscated by default. It should be a toggle that is off on page load. Shoulder surfing is a corner case.
Cameras are everywhere in public spaces, and most people wouldn't notice a password field wasn't obfuscated until they've already started typing. Defaulting to obfuscated seems the only sensible option.
No way. The number of reported cases of passwords being stolen simply by physical proximity is enough to make this a sensible default. I agree that there should be an option to show the password as you're typing or, at a minimum, once you're done typing (less secure) but making that the default is unreasonable.
This is my pet peeve. Password fields should not be obfuscated by default. It should be a toggle that is off on page load. Shoulder surfing is a corner case.