> Every time you're about to paste your password, glance at the url bar.

Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link.

The only safe way is to type the url yourself into the browser.

If it is a long link - then at least typing the base domain, and pasting the "rest" is probably safe?