@ Anonymous Coward : You over-estimate the general populace. How many people get infected with spyware/malware/viruses every day? How hard is it to think - "Do I really want to install this thing I didn't ask for that popped up in my face? yes/no" /click yes anyway.

If you try to use HPPTS the web page will error with an invalid security cert. because the page is not what gmail.com is serving.

@ Andrew Langhorn : He was doing a proof of concept - reproducing the web page with malicious code.