Actually, I think it may just be a better idea to prompt for a master password if someone click's show password. Since chrome can be tied to your google account I think using your google account password plus the second verification step before you can show any of the passwords would be a good solution. That way, your passwords are saved, and if you want to see them you need to verify that it's you.