JavaScript (and other forms of executing logic within the browser) have made the situation worse, though.
replyTo me, there's a big difference between a domain misread and actively malicious code running in the browser context as a design point.
If a malicious site gets your password, I'm not sure why it matters whether it happened in the frontend or not.
reply