RSA's implementation (used by BofA, among others) is called SiteKey: http://en.wikipedia.org/wiki/SiteKey http://en.wikipedia.org/wiki/SiteKey These never seem

RSA's implementation (used by BofA, among others) is called SiteKey: http://en.wikipedia.org/wiki/SiteKey http://en.wikipedia.org/wiki/SiteKey These never seemed very secure to me for the reason mentioned in that article: The obvious flaw in the design is that a phishing site can get the correct SiteKey info from the genuine site, then serve it to the user, "proving" its legitimacy[1]. SiteKey is thus susceptible to a man-in-the-middle attack. But at least it requires the attacker to connect to the website, which gives them opportunity to block hosts that are known or suspected to be phishing users.