Interesting. I thought my bank's security was lacking, but at least it is impossible to scrape my data off it even if I give you the password. You have to go through the browser's main security certificate thingy to "decode" the RSA key that is then sent to the bank. It's impossible to login without it or get to any sort of data (afaik)