To be fair to MS, a local bank switched their systems and introduced a vuln that leaves the username and password in the form as it opens the account in a new tab. It's still there 3 weeks later.

Edit: This is sarcasm but the bank story is true.