I used to use a discussion forum website that didn't encrypt cookies. A friend created a 1x1 pixel transparent flash app that read everyone's user name and password and transmitted it to him.