Is it possible to use encrypted passwords with the force.com migration toolkit and not save it in plain text in the properties file.
You could do some sort of encryption that you can decrypt as an ant target task - like a base64 decode or something.
The problem with that is anyone who's savvy enough to be able to look in the configuration files for your password is probably savvy enough to simply decrypt it themselves.
What I do - and would recommend - is pass the password, and maybe even the username, in as a parameter of the ant job. That way the password will only persist in the call itself (and whatever more secure password store you use) and you can do masking to hide the value.
In your call to ant do:
ant target -DsfPass=passwordvalue
And in your build.xml target you can access sfPass: