'Secure' PayPal page is... you guessed it | The Register
http://www.theregister.co.uk/2008/05/16/paypal_page_succumbs_to_xss/