[letsgetphysITal]

That's true. However, using credentials harvested in this way is almost certainly going to constitute unauthorised access of a computer system and a breach of the Computer Misuse Act.