You don't need a key-logger to collect passwords -- on login forms, users will occasionally type in password from other sites. Worrying.