[manifesto]

Yeah but what to stop me from serving a fake popup over https://myfraudsite.com?

[jszymborski]

Nothing, but you can't hide that it is https://myfraudsite.com from the user since the browser always displays the URL (at least it does nowadays).