I'd consider myself a savvy user. I don't run NoScript, nor do I always notice when the auto-password feature doesn't work because I use multiple browsers and t

I'd consider myself a savvy user. I don't run NoScript, nor do I always notice when the auto-password feature doesn't work because I use multiple browsers and they don't all have the same credentials. Nor do I (think I) always scan the URL when I switch tabs-- though surely I'll do more of that now. This won't work against most savvy users on their best days. It will probably work against most savvy users on any given bad day. What's interesting to me is that it'd be pretty easy for a site owner to target very specific users who visit their site. I could easily see this being used by a rogue employee at a web company to gather credentials/info on a specific target VIP and then covering their tracks later.