“This is more severe than it initially looked like: Due to TLS Server Name Indication (SNI) the hostname as parsed by Lynx (i.e with “user:pass@” included) is sent in _clear_ text over the wire even _before_ I can even said “n” for “no, don’t continue to talk with this server” in Lynx’s prompt as shown above.”
Put a username and password in a URL and Lynx treats the whole thing as the hostname. It then sends that hostname in the clear during the TLS handshake. The certificate warning shows up after the password has already left. Anyone on the wire can read it with Wireshark.