The argument the demonstrators make is that the SiteKey protection is useless. I would counter that this is not the case. Their demonstration does illustrate

The argument the demonstrators make is that the SiteKey protection is useless. I would counter that this is not the case. Their demonstration does illustrate that the man in the middle attack can work for a small number of phishing attacks. The attacker gives up something in order to pull the man in the middle attack off that they wouldn't otherwise need to. The server that is running the attack has to actually make an http request to Bank of America in real-time. It need not be that exact server, but some server has to do this. If it is a real web server, Bank of America could do interesting things if they are suspicious of the login, for example probing port 80 (in real-time or asynchronously). Or, keeping a database of ip addresses that are known to be ISPs versus datacenters (presumably the demonstration was done from an ISP ip address). If the attacker somehow re-routes the request through a real ISP in real-time, it becomes easier to track the attacker in the real (legal) world. Now all of the sudden the ISP knows the address of the attacker, can track down the machine doing the attacking, etc. In either case, Bank of America can detect the attack very quickly because of a large number of unique connections from the same IP address. If the attacker goes one step further and re-routes the sitekey requests through a botnet, then bank of america loses alot of defenses. The botnet is on real machines on real ISPs and always a different IP address. But this makes it much harder for the attacker to pull off because they have to set up a botnet.