diff --git a/master/NEWS b/master/NEWS
index 0d3b8fd4748..d638a5273d4 100644
--- a/master/NEWS
+++ b/master/NEWS
@@ -30,6 +30,9 @@ non-functional, and has been removed. (#1059)
 
 *** contrib/hg_buildbot.py was removed in favor of buildbot.changes.hgbuildbot.
 
+*** The misnamed sendchange option 'username' has been renamed to 'who'; the old
+option continues to work, but is deprecated and will be removed. (#1711)
+
 * Buildbot 0.8.2
 
 ** Upgrading
diff --git a/master/buildbot/changes/hgbuildbot.py b/master/buildbot/changes/hgbuildbot.py
index 5cda8c1cb3a..da9ecb6444b 100644
--- a/master/buildbot/changes/hgbuildbot.py
+++ b/master/buildbot/changes/hgbuildbot.py
@@ -95,7 +95,7 @@ def hook(ui, repo, hooktype, node=None, source=None, **kwargs):
             if branchtype == 'inrepo':
                 branch = workingctx(repo).branch()
 
-    s = sendchange.Sender(master, None)
+    s = sendchange.Sender(master)
     d = defer.Deferred()
     reactor.callLater(0, d.callback, None)
     # process changesets
diff --git a/master/buildbot/clients/sendchange.py b/master/buildbot/clients/sendchange.py
index a2f7af612eb..cfca55f4865 100644
--- a/master/buildbot/clients/sendchange.py
+++ b/master/buildbot/clients/sendchange.py
@@ -4,24 +4,22 @@
 from twisted.internet import reactor
 
 class Sender:
-    def __init__(self, master, user=None):
-        self.user = user
+    def __init__(self, master, auth=('change','changepw')):
+        self.username, self.password = auth
         self.host, self.port = master.split(":")
         self.port = int(self.port)
         self.num_changes = 0
 
-    def send(self, branch, revision, comments, files, user=None, category=None,
+    def send(self, branch, revision, comments, files, who=None, category=None,
              when=None, properties={}, repository='', project='', revlink=''):
-        if user is None:
-            user = self.user
-        change = {'project': project, 'repository': repository, 'who': user,
+        change = {'project': project, 'repository': repository, 'who': who,
                   'files': files, 'comments': comments, 'branch': branch,
                   'revision': revision, 'category': category, 'when': when,
                   'properties': properties, 'revlink': revlink}
         self.num_changes += 1
 
         f = pb.PBClientFactory()
-        d = f.login(credentials.UsernamePassword("change", "changepw"))
+        d = f.login(credentials.UsernamePassword(self.username, self.password))
         reactor.connectTCP(self.host, self.port, f)
         d.addCallback(self.addChange, change)
         return d
diff --git a/master/buildbot/scripts/runner.py b/master/buildbot/scripts/runner.py
index ea9396eff6d..6e4a5e2cd1f 100644
--- a/master/buildbot/scripts/runner.py
+++ b/master/buildbot/scripts/runner.py
@@ -771,7 +771,10 @@ def __init__(self):
     optParameters = [
         ("master", "m", None,
          "Location of the buildmaster's PBListener (host:port)"),
-        ("username", "u", None, "Username performing the commit"),
+        # deprecated in 0.8.3; remove in 0.8.5 (bug #1711)
+        ("username", "u", None, "deprecated name for --who"),
+        ("auth", "a", None, "Authentication token - username:password, or prompt for password"),
+        ("who", "W", None, "Author of the commit"),
         ("repository", "R", '', "Repository specifier"),
         ("project", "P", '', "Project specifier"),
         ("branch", "b", None, "Branch specifier"),
@@ -789,6 +792,7 @@ def __init__(self):
 
     buildbotOptions = [
         [ 'master', 'master' ],
+        [ 'who', 'who' ],
         [ 'username', 'username' ],
         [ 'branch', 'branch' ],
         [ 'category', 'category' ],
@@ -808,7 +812,11 @@ def sendchange(config, runReactor=False):
     connection will be drpoped as soon as the Change has been sent."""
     from buildbot.clients.sendchange import Sender
 
-    user = config.get('username')
+    who = config.get('who')
+    if not who and config.get('username'):
+        print "NOTE: --username/-u is deprecated: use --who/-W'"
+        who = config.get('username')
+    auth = config.get('auth')
     master = config.get('master')
     branch = config.get('branch')
     category = config.get('category')
@@ -836,11 +844,20 @@ def sendchange(config, runReactor=False):
 
     files = config.get('files', [])
 
-    assert user, "you must provide a username"
+    # fix up the auth with a password if none was given
+    if not auth:
+        auth = 'change:changepw'
+    if ':' not in auth:
+        import getpass
+        pw = getpass.getpass("Enter password for '%s': " % auth)
+        auth = "%s:%s" % (auth, pw)
+    auth = auth.split(':', 1)
+
+    assert who, "you must provide a committer (--who)"
     assert master, "you must provide the master location"
 
-    s = Sender(master, user)
-    d = s.send(branch, revision, comments, files, category=category, when=when,
+    s = Sender(master, auth)
+    d = s.send(branch, revision, comments, files, who=who, category=category, when=when,
                properties=properties, repository=repository, project=project,
                revlink=revlink)
     if runReactor:
diff --git a/master/contrib/darcs_buildbot.py b/master/contrib/darcs_buildbot.py
index ff8bbe6acb2..a226fb299e3 100755
--- a/master/contrib/darcs_buildbot.py
+++ b/master/contrib/darcs_buildbot.py
@@ -137,7 +137,7 @@ def findNewChanges():
 
 def sendChanges(master):
     changes = findNewChanges()
-    s = sendchange.Sender(master, None)
+    s = sendchange.Sender(master)
 
     d = defer.Deferred()
     reactor.callLater(0, d.callback, None)
diff --git a/master/docs/cmdline.texinfo b/master/docs/cmdline.texinfo
index a99589e956f..05f04e8da67 100644
--- a/master/docs/cmdline.texinfo
+++ b/master/docs/cmdline.texinfo
@@ -458,12 +458,18 @@ VC server. It requires that you have a PBChangeSource
 (@pxref{PBChangeSource}) running in the buildmaster (by being set in
 @code{c['change_source']}).
 
-
 @example
-buildbot sendchange --master @var{MASTERHOST}:@var{PORT} --username @var{USER} @var{FILENAMES..}
+buildbot sendchange --master @var{MASTERHOST}:@var{PORT} --auth @var{USER}:@var{PASS} \
+        --who @var{COMMITTER} @var{FILENAMES..}
 @end example
 
-The @code{master} and @code{username} arguments can also be given in the
+The @code{auth} option specifies the credentials to use to connect to the
+master, in the form @code{user:pass}.  If the password is omitted, then
+sendchange will prompt for it.  If both are omitted, the old default (username
+"change" and password "changepw") will be used.  Note that this password is
+well-known, and should not be used on an internet-accessible port.
+
+The @code{master} and @code{who} arguments can also be given in the
 options file (@pxref{.buildbot config directory}).  There are other (optional)
 arguments which can influence the @code{Change} that gets submitted: