>some users (or really all users some of the time) will always be willing to enter their password into some other box which looks nothing like the one that webp

>some users (or really all users some of the time) will always be willing to enter their password into some other box which looks nothing like the one that webpages are prevented from mimicking. Phishing sites mimick real user sites because that greatly increases the success rate. You can always find someone who will do something, the important question is how often. I don't think we should just throw up our hands and say user problem are unsolvable with technology. Good UX solves user problems, compare an AppleII to a iPad. We have two problems: 1. it is easy to mimic password prompts, 2. it is hard for computers to tell who is legitimate and should be sent the password. This solution solves both.