What would you recommend more specifically? In particular, whatever LastPass is doing seems likely to be fragile unless there's consensus about how to identify a form as one that accepts tokens (usually a username/password combination) to authenticate an existing user, or similarly set parameters for a new user, or change authentication tokens, or…

In the Unix world, there are various extant mechanisms for this around: PAM, LDAP, &c. However, I haven't detected any published rough consensus for the Web; searching for terms like “design login form common field names username password” doesn't turn up anything obvious.

The only strong heuristic that I can think of is detecting form fields of password type, and then distinguishing the use cases temporally based on whether you already have tokens cached.