> some such sites intentionally break pasting into the password field

You can fix that with a bookmarklet to re-enable pasting.

  var inputs = document.getElementsByTagName('input');
  for (var i=0; i < inputs.length; i++) {
    if (inputs[i].getAttribute('type').toLowerCase() === 'password') {
      inputs[i].setAttribute('onpaste', '');
    }
  }

(Tested with desktop Safari, no idea about other browsers.)