Behold, a password phishing site that can trick even savvy users

Anecdata, but I think this method is popular with Steam phishing sites. I have received a few links that mimicked the Steam web login prompt with a Windows window appareance.

This goes way back to the bad old days of 90s web popups that attempted to look like Windows dialogs.

Luckily for everyone the spammers couldn't resist the temptation to throw in a few brightly coloured police tape GIFs, radiation symbols, typos, bold fonts in about 6 sizes and otherwise generally spoil the illusion.

My friend, who is the security-minded administrator of a somewhat huge public XMPP server, told me that he always disables Autofill/AutoType. He uses KeepAssXC and manually copy-pastes his details into forms. Said that he doesn't trust autofilling because of JavaScript exploits which would compromise his passwords. I don't recall if he mentioned it or not, but I'm pretty sure he also uses some utility that wipes his clipboard every so often (if KeepAssXC doesn't do that automatically)