> But you also need to serve the page that links to the form via https Yes, in the limit. But current best-practices for user caution ("when you're entering pe

> But you also need to serve the page that links to the form via https Yes, in the limit. But current best-practices for user caution ("when you're entering personal information, check the address bar for the domain name you're expecting [and a lock icon]") would be enough to thwart that attack.