[jfrunyon]

Uhh... yeah, just typing the password (or letting your password manager autofill when you get cache poisoned or whatever) has always been enough to get you. onkeydown has existed longer than phishing.