dude, i mentioned those for 2 reasons: 1) to say that coded hacks are not possible, not at least by non-super-geeks like me. 2) because u asked. okay, the simplese implementation of javascript would have been to load the fake page in the same page, not in a seperate window. ppl wouldn't look at the address bar too much. i know this from experience. even my most crude phishing worked. anyway, if you have someone working at your computer, can't u think of any non-moronic way of finding the what someone typed in your computer? seriously. this mostly works, because ppl mostly want passwords of ppl close to them, like girlfriend or son or wife or whatever. come on. the internet is full of these things.