> Is that correct? Yes, that's the classic XSS attack pattern. It's like phishing, but better since you're sending the person a link to the actual website. And

> Is that correct? Yes, that's the classic XSS attack pattern. It's like phishing, but better since you're sending the person a link to the actual website. And once they've clicked on it, they're already screwed; they don't even need to manually enter any information. > how? Once you have the cookie, its as simple as something like making an XMLHttpRequest to your own server that includes the decrypted email and password from the cookies.