"While an attacker would be able to easily capture both the username and password entered into the fake site, the Red Team determined that only capturing email

"While an attacker would be able to easily capture both the username and password entered into the fake site, the Red Team determined that only capturing email addresses or login names was necessary for this exercise." It says in the article that they never asked for passwords. I wonder if the statistics would have been different if they did? You usually think twice before entering a password.