Absolutely. Which is why I think we still have a lot of work ahead of us, making...

undergrowth54 · on Nov 4, 2016

Having them use a passsword manager is a better apporach. Checking the domain name is weak to keming probiems.

phlo · on Nov 4, 2016

...and password managers are weak to lots of problems [1], the least of which is malware stealing your password container plus the master key [2].

I'm still leaning towards the password manager side of the dilemma, but the situation isn't great on either.