New security tip, drag every login pop-up windows outside of your browser.. if the window can move out of the browser.. it's (more likely) legit (or at least you know the address bar is real to check), if it doesn't then you're being phished.