This has been tried in the past, I remember when Yahoo had a system to put a secret image on their login page with the exact same sort of goal (avoid phishing).

This has been tried in the past, I remember when Yahoo had a system to put a secret image on their login page with the exact same sort of goal (avoid phishing). Regular people don't use/understand such a system (enough to make it worthwhile).