Would this not still be phishable? All an attacker would have to do is make a website look enough like the real thing, then use a plain <form> element and captu

Would this not still be phishable? All an attacker would have to do is make a website look enough like the real thing, then use a plain <form> element and capture the submitted form content. I would think an out of browser app might work better for that task.