social engineering is the attack vector, as always. a person presented with "THIS IS INSECURE!!!!1 TURN BACK NOW" when going to mybank.com will just press "Con

social engineering is the attack vector, as always. a person presented with "THIS IS INSECURE!!!!1 TURN BACK NOW" when going to mybank.com will just press "Continue" because they can't be bothered, but also because that error is a red-enough herring (self-signed certificates, legitimately expired certificates, people using older OSs with stale CA bundles) for people to ignore. yes, VPNs obviate this concern, but also many people don't use VPNs.