This argument reminds me of how Google refuses to show the server-provided login prompt when doing HTTP basic auth in Chrome (and as a consequence, browsers der

This argument reminds me of how Google refuses to show the server-provided login prompt when doing HTTP basic auth in Chrome (and as a consequence, browsers deriving from it). Some developer argued that someone could MITM the connection and make the basic auth login prompt say "please enter your YouTube credentials" or something like that. Yeah right, if you can MITM the connection, you could just as well inject a much more realistic Google login page. Basic auth really wasn't the actual problem at hand.