2) this assumes there aren't any third parties on your friend's machine. You're trusting not only your friend, but likely Apple/Microsoft, Chrome/Firefox, and any browser extensions they might be running, which would definitely become more aggressive and pervasive if this scheme became common practice.