The login page for Google Mail can be spoofed so that an attacker can steal a user's credentials.