The only way to check is to verify the certificate, Or use a U2F key as a second factor. Avoiding MITM fishing attacks is one its explicit design goals. In sho

The only way to check is to verify the certificate, Or use a U2F key as a second factor. Avoiding MITM fishing attacks is one its explicit design goals. In short: the MITM does not have the right key handle, so it cannot initiate the challenge-response. https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview.... https://developers.yubico.com/U2F/Protocol_details/Key_generation.html https://developers.yubico.com/U2F/Protocol_details/Key_gener... https://developers.yubico.com/U2F/Protocol_details/fido-u2f-overview-v1.0.pdf https://developers.yubico.com/U2F/Protocol_details/fido-u2f-... U2F is supported by Google and Dropbox (since one or two weeks). Keys cost ~10-15 Euro a pop. Buy two keys, keep one with you, put the other in a fire-proof safe.