Which is why I have a process running, inspired by phish filters and early viruses, that detects whenever I enter the key sequence that is my root password, and kills the process that's recieving those keys before I have chance to hit enter...
...I can't disable it...
I really didn't think that one through.
What I should've done was make the su app give *me* a system identifying password, which I then respond with the second half. Imitation *su apps wouldn't be able to read the challenge string, so I would never be fooled by something that merely asked me for a password.