During a release build just now I opened Firefox and just as I started to type a search query the password for signing modules appeared in the search box! It seems it would be very easy for some malware to trap the password.
Are you using .spc and .pvk files to sign your installations? If so, you may want to switch to a .pfx file. For more information, see Digital Signing and Security.
As described in the article, using a .pfx file is preferred over the other file types. Microsoft SignTool.exe (the tool that InstallShield uses when you specify a .pfx file for your release) accepts a command-line parameter for the password, so you would not run into the behavior that you encountered if you switched to this for signing.
Microsoft Signcode.exe, which is called if you specify .spc and .pvk files to sign, does not accept command-line parameters for the password. So, the build has to pass the password to Signcode.exe when prompted for it, as you encountered.
