It’s no doubt a browser issue since users come to SSL by either clicking on a link or getting redirected, both of those spots are highly vulnerable to attack.

So there you have the “fake page” loaded up, misleading the user to think they’re on a legitimate, secure page, when in fact they are not. It does nothing to directly compromise the encryption, and it’s based entirely around user error.

The fix: educated users to recognize phishing, scam sites, etc. and on the other side employ more robust encryption via EV SSL, where it’s near impossible to recreate a Man-in-the-Middle attack (spoofing the green url bar or extended validation credentials)