[akronim]

If I was writing one I'd just be logging posted form fields with a transparent proxy, almost seems easier than a key logger.

[mvermaat]

Except that doesn't work if the form posts to a HTTPS URL. You'd have to implement something at the browser level, e.g. installing a modified browser or a browser extension.

[jasonmc]

It is possible to perform a MITM attack on HTTPS when you can install any certificates you want in the web browser.