bug in password hiding when using lists for passwords