DNS poisoning can steal credentials all bets are off as multiple security mechanisms have failed.