The Google OAuth attack is pretty sneaky indeed. I noticed the popup being created, positioned, and hidden upon the first click but I highly doubt most regular users would. I wish there was an option in Chrome to force new tabs to be opened instead of new windows and to completely disable popups for all sites, always. I can't think of any reason why a site needs popup anymore, especially since IFrames, OAuth, LightBox, JSONP etc. can handle pretty much all the rich-media use cases.
