Originally Posted by docbert

However if you instead typed "http://www.bankofamerica.com", and didn't notice that you were actually redirected to https://www.bankofamercia.com, then you've got a problem... Because the original site you went to wasn't over httpS then someone intercepting the traffic can easily redirect you to another site. Even though your access to that site might be over https/SSL, the certificate verification will still succeed (and the lock will show) because at the end of the day you ARE talking to the "real" bankofamercia.com! (You did notice the difference, right?)