> But it sounds like ISPs were just sniffing HTTP packets for usernames and passwords Nope, Facebook's login page, if requested over http, was manipulated on t

> But it sounds like ISPs were just sniffing HTTP packets for usernames and passwords Nope, Facebook's login page, if requested over http, was manipulated on the fly to inject a javascript code that is triggered when the login button is clicked. It retrieves the login/password values from the form and sends them to another url, besides Facebook's login url.