Injecting JS into the page with the form isn&#x27;t my main concern, even -- it&#x27;s changing the form POST action to their own server rather than the one I think I&#x27;m logging into. That&#x27;s much harder to detect and block without encryption.<p>Plaintext HTTP is scary stuff these days.