Another thing that's bitten me from time to time is what might be called FocusNabbing: where you're entering a password into one site and something else steals

Another thing that's bitten me from time to time is what might be called FocusNabbing: where you're entering a password into one site and something else steals the focus, so now you're potentially typing part of your credentials there. It could be some other application running in your OS showing a modal alert or some other tab suddenly stealing focus (looking at you, Google Calendar). While this attack vector is far more difficult to exploit, there should be protection against this kind of focus stealing. If your browser detects that you currently have the focus in a password field, it should block any attempt to switch the focus away to something else. The same should apply to the OS itself.