If I'm reading this correctly, there has to be a malicious user at the
console of a logged in computer (or connected in some other
authenticated way). If I have a malicious user at my console logged in
as me, I've got more problems than web form passwords being revealed.

Am I reading this incorrec...

[ more ]