that's a nice idea, but you can already use SSL in Piwik: http://piwik.org/faq/how-to/faq_91/

Sounds like a slight improvement if the traffic is only sniffed. If you have a man-in-the-middle, Eve could just change the action of the form or inject a JavaScript keylogger. TLS is the only meaningful way to secure the login credentials, since the auth cookie could still be stolen.

yes it's only a slight improvement, what it helps is a user prevent someone reading the actual plain password string. But TLS should be used instead for sure. I'll close this ticket for now, if you disagree please comment!

I think it is fine to close this and focus on more important things. Piwik will benefit from having a stronger hashing algorithm and TLS on the installation site than to give the user a false feeling of security against attackers that for some reason only decide to listen to the authentication phase (and not the cookie).

Cheers, I love adding wontfix to issues, wish we could do it more!