Well there is the problem! Letting IE save your passwords is a major problem because all a XSS attack needs to know is where IE stores them. There is also a plethora of tools that crack IE in this same fashion. Tell your friends that storing their passwords is more dangerous than worrying about key loggers. =P