Is the concern here phishing? Checking that the page is HTTPS and the domain is *.google.com should be sufficient to thwart phishing attempts. Of course, your attack would still work against uninformed users, but you can protect yourself by always being sure to check the URL.