That assumes that a phisher would use the system API for creating a prompt. It's possible for them to draw a dialog that looks just like the system dialog on t

That assumes that a phisher would use the system API for creating a prompt. It's possible for them to draw a dialog that looks just like the system dialog on top of the regular application chrome. Once Apple has trained a user that it is ever okay to type this information in, the cat is really out of the bag.