"- XMir always listening to keyboard, passwords may appear in other X
sessions" is mentioned in the original mail, right down at the bottom. The Mir team appear to have been fully aware that it was a security sensitive problem.