There have been several security systems over the years with this same problem. The issue is basically here: Step 1: Require users to install a binary plug-in.

There have been several security systems over the years with this same problem. The issue is basically here: Step 1: Require users to install a binary plug-in. (OK, the website doesn't exactly say it that way.) But web security begins and ends at the user. All of the security depends on the user noticing security warnings and then refusing to continue. Look at it from the user's perspective. "In order to create an account on this website you must turn off your malware blockers, click here, then click 'OK' to the next 3 warning screens that are going to tell you that what is about to happen is a really bad idea. Trust us, we're legit." I would wager any site that places selection pressure on their userbase to favor those who agree to install random binary stuff from the web is going to have more issues with user credentials than those which do not. Disclosure: I work for an authentication company (PhoneFactor) that has replaced these plugin-based systems in the past.