Good description cwolf. The separation of different types of information into different DMZs is very critical from an enterprise standpoint. I always explain it like walls of a castle. This particular bug though, as I understand it, was not infecting web servers. It was purposefully dropped onto web servers to harvest data from IE users stored password data. So, the concern was more towards a users local machine. The hackers had initially used it to obtain game passwords, but there was nothing stopping them from going farther. Now, keep in mind that this would only be useful for simple one-factor authentication -- if both your username and password are stored together on a single page. All banking applications were forced to move onto a multi-factor authentication over a year ago. So, if your computer is not registered, then it should ask you for a piece of personal information as well, that a hacker would not have the ability to obtain (unless they were trying to selectively social engineer you (See Palin, Sarah email)). Additionally, with some simple measures on a webpage, you can alter the form field names to disallow the saving of passwords. This is something all sites should do. In fact, I think browsers should simply disallow the saving of any passwords, period. If you want a simplified password management, then use something with a thumbprint scanner or the like.