&gt;He asks me to go to Live.com (the Microsoft email site) and enter a random username and password. A few seconds later, the information I just typed appears on his screen. “Now I have the login details of your email account,” Slotboom says. “The first thing I would do is change the password of your account and indicate to other services you use that I have forgotten my password.<p>What&#x27;s happening here? The author&#x27;s browser would report that the connection is un-certified, and that would be a red flag if the author had checked, no?<p>Would there be any demand for a service that checks if a website <i>should</i> have a valid cert? Would it make sense to have this built into the browser?