external "booking tool" to allow login through external website
===

I have a booking tool which you "install" in an external website by inserting a single javascript from our server in your website and create a div node which we detect, when the javascripts loads, it executes a call to a webservice and then will load the html over a JSON response from our webservices and insert into the div node.

so basically, our tool "melds" with your website and we're very careful to namespace all our css and javascript to stop us from interfering with your website, to the point of a little paranoia :)

once our tool is installed, it runs all the webservices to our server to retrieve data.

the part I'm stuck on, is how to secure the login data, basically, we have a problem here, we don't know the people who own the external website and they are allowing people to register and login to our tool in order to buy our services, we store, process logins and give tickets to events and functions using that tool.

the problem we have is that those credentials can be stolen because the website has access to the html, javascript and probably can do some naughty jquery tricks to grab the username and password data.

I'd like to stop that if possible.

how could I secure the login, so I can embed the tool in any website (http or https) and protect the usernames and passwords entered into the tool and used to login.

any ideas?