Mark password boxes in red if they are on an unsecured page (i.e. not using SSL, as implied by using an http: URL rather than https:).

This is a pretty trivial defense, so don't depend on it to heavily, but it's a very useful extra warning when at high risk such as _USING WIRELESS---ESPECIALLY IN PUBLIC_, where password sniffing is not only trivial but remarkably common.