OhhWell wrote:
If the router is compromised, you are still screwed; right after you put your login info into what you thought was your bank's website.
Even if the router is compromised, the SSL would still not validate properly. Your computer has the root trusts for who can issue an SSL, so even if they compromise the router and redirect you to a site with the exact same name as the banking site, you will get the SSL error. As long as you make sure you have https: and the name of the site correct, gaining control of the router is irrelevant. Your data to your banking site from home will always go across many routers that other people own. SSL is end to end, no matter who is in the middle.
The higher risk is in the user typing in a bad URL or clicking on a link with a URL that looks similar to the bank site, but isn't.