Seeing how big names like Gmail, Yahoo! (despite the login seal) and Hotmail (Live Mail) are prone to phishing attacks, this raises the question of whether it is possible (theoretically) to safeguard a website login form from phishing scams?

Now before we go in answering whether it is possible to (theoretically) phish-proof a website, I understand that we need to establish a few factors.

1. What is the general method used for creating a phish login page? Is it possible to counter this *generalized* phish-page-creation method? That is, if a programmer is able to defeat the "generalized" phish-creation-method, can he/she expect to make a major change in the security industry?
2. What is the programming and tech understanding of the **majority** of phish-hackers? If it is not possible to completely phish-proof a website's login system, is it possible to effectively push out 80-90% phish-makers out of the game by making the phish-page-creation a complex and difficult process?
3. What is the theory behind some of the phish-proofing mechanisms in practice today (Yahoo login seal etc)? Are these methods effective? If the methods are practically ineffective, is it possible to improve the efficiency of these methods while sticking to the same theory/idea? Or is it the very approach which is erratic?

I know experts would have varying views on these matters, but I hope I could at least find some points of consensus on these issues.