You could load gmail or facebook or any other site in an iframe and tell the user to login, but you would intercept his credentials with javascript.

Hmm that is a fair point.

Maybe a more secure alternative to iframes can emerge. Something like Chrome's WebViews.

Even though as of right now native browsers can intercept your data as well, it's a matter of trusting the tool.

How exactly do you use javascript cross domain like that? i'd love to know.

You don't. You register a key press event listener on the main page and when the user types into the iframe, you can catch the strokes.

Example: http://www.jayssite.com/misc/iframesample.html (not my site, I googled it)

i don't think this example is cross-domain...