How bad is it to set password text

Question

For <input type="password" />

In ASP.net:

PasswordField.text = RawPasswordString;

This doesn't work, but can be circumvented with:

PasswordField.Attributes.Add("value", RawPasswordString);

I'm doing this so when the registration form fails, they don't need to re-enter their passwords if they were valid, this annoys me no end on some websites. We have a CAPTCHA field that needs server validation, so when this fails (the most likely field to fail), I don't want them to enter a correct one, but then the passwords fail because they cleared, meaning they have to enter the CAPTCHA again .

What are the security reasons, and if this page is on HTTPS is that OK? If it's on HTTPS with nocaching, what else should I be aware of?

Answer 1

Absolutely not. Browsers still can cache the result and someone can look at the cache and take the password.