Originally Posted by
gfunkdave
As you said, TLS addresses the MITM issues you raise.
TLS helps, but in most cases it still relies on the user to notice if something is wrong. Other related things like HSTS help improve that, but there are still holes.
It's a few years old and there have been improvements, but
this post from a similar thread here a few years ago explains some of the issues, even with SSL/TLS.