I'm not writing login code personally but this sounds like something fundamentally broken in the web and asking devs to fix it case by case is a complete copout. If a browser can detect this shit, why can't it fucking proxy it or do something clever to mitigate it automatically instead of putting up stupid hyroglyphs and expecting to shame developers into duplicating a bunch of work case by case and thereby probably getting it wrong in many cases? .. like.. ff detects insecure login form.. Browser DON'T FUCKING SEND CLEARTEXT PASSWORD (instead sending some encrypted bs to firefox grand central station, where it is securely forwarded through a secure backchannel? Maybe it has to talk to the isp directly who has to inject the password back into your process, and they charge u extra tax for securing your shit.. and then.. gasp.. problem solved and not every aspiring developer needs to become a cryptographer.

Passwords are stupid. The internet is broken. My Spyware infested machine and browser knows all my passwords anyway.

Note to any techies reading this.. fix this problem. Here is your killer app. Disrupt this shit.