The EditText of the SSH tunnel password input dialog uses autocomplete and so
the "hidden" password can be seen in the autocomplete line.
A patch (untested - sorry, no time to search all the necessary libs for
building atm) is attached to the report. Maybe it's necessary to add
InputType.TYPE_CLASS_TEXT to the flags, too. But for me it worked without that
flag in my apps.