3 ms·

The spoofing site wouldn't/shouldn't be able to pass the browser validation of the TLS server side certificate.

• StavrosK 9y ago
  Why not? How hard is it to get a cert for a domain that looks like paypal-businesscenter.com?
  • cjwhite 9y ago
    Moreover, the browser could remember the expected shared secret based on its and the server's RSA exchange.