I believe it also validates the site via ssl to killnphishing. with passwords you can still trick users.