> with some sort of visual, non-spoofable indication by the browser, such as the titlebar blinking green or some such thing Then I'd put some secure password b

> with some sort of visual, non-spoofable indication by the browser, such as the titlebar blinking green or some such thing Then I'd put some secure password box 500 pixels above the top of the page to make the titlebar blink green, and then make the input box the user is typing in be a normal one. Instead make the text box blink green and I'd fake that with javascript. In fact, anything that shows up on the page and you can fake it with images and javascript. Or flash. Or a canvas tag. Sure, the people who really know what they're doing could view the page source or confirm through other methods that this is the real password box -- but those guys are already using passwords better than "password123". I'm not saying it's impossible, but you have to realize how difficult it is to get the average user to recognize 'this is a real secure password box' versus 'this is a fake one that looks real.'