Or...
Do the stories tie together?

Or better yet, do all that, then throw a few unmarked "red flag" cables down and act like it's a matter of immediate national security the instant they get cut.

The public thinks you have secret cables, and they're still clueless.

Or, perhaps the simplest solution: talk Twitter into letting you use more than 140 chars.

"cURL" out to those sites?
Sir, if we had the credentials needed to send a cURL request with your cookies (to see if you were logged in), you've already been hijacked. (cURL requests are server-side.)

The vulnerability comes more from the fact that some browsers let JavaScript "see" what the URL of another window is.

Oh, that, and many people won't notice that the URL isn't form their bank.

Funny, though. A modern pop up blocker will stop this 9/10 times (unless you do the infamous body.onclick trick).