4 ms·

This problem was solved in 1999 with client-side certificates. Your browser would simply refuse to log you into the fake bank site.