Is this flash based or is it an iframe? How are they mitigating the risk of malicious sites that steal a users credentials as they are entered into an observable DOM hierarchy?

Edit: Looks like authentication is entered into a pop-up window, but still I'm not convinced that it's secure.