Make elements that have neither id or name also identifiable by codes (example: elements that have onclick="something()") Compare response time between login attempts (which may indicate a successful login)