Mostly on sites that both have traditional login forms and use forms where other fields are mis-identified as password fields.