Stage 1:
I signed up for a free account at nytimes.com, and said yes in both browsers to remember the password.

Observations:
At least Firefox, and probably IE encrypt both the username and the password.

In Firefox's case, I haven't done any exploration of the encryption method. I will get to it later. For starters, it stored everything in c:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\aer7j1o6.default\signons.txt. The info it stored appears thusly in the file:
#2c
http://www.antionline.com
.
http://www.nytimes.com
USERID
MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECM0Ru06n5UpCBAhw6jd+7Exfjg==
*PASSWORD
MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECFKX05abTK1IBAj0HQsw2RFJbQ==
.
Whatever it is using to salt the encryption algorithm generates a consistent first 45 bytes of data, with only the last 25 bytes variable. Interestingly, I used the password and username the same, but it still provided different encryption results (though it does help to explain the similarities, I would venture). This is definitely not a simple base64_encode(), it is definitely encrypted. How, I am not sure, and am going to save for another day, just like I'm going to save playing with the rest of IE for another day.

In IE's case, all that is held outside the "Protected System Storage" is the ID for the site, which is stored in:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Intelliforms\SPW as a DWORD called "8[H=?2N=/5BLV #", or "38 5b 48 3d 3f 32 4e 3d 2f 35 42 4c 56 20 23" in hex.

I'll append more on this when I get the opportunity.