>When using a passwordchar, you can copy the masked contents using ctrl-c
>When you paste this in a textdocument, voila, the password is revealed.
>This seems a serious issue since all protection is bypassed using two keyboard commands.
>Is there a workaround for this?
>But keep in mind a user must be able to type in the textbox to change the password.

I'm really ask myself (and not at last you) where exactly the problem is?
I mean, the person, who is typing in the password should know the password. So who cares if this person reveales his own password using ctrl-c?

I wouldn't call this a serious issue.