3 ms·
> so it can't be fooled by impostor websites, however clever Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying
by craftyguy 8y ago
> so it can't be fooled by impostor websites, however clever
Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying that the hostname matches the cert... (big assumption)
In any case, I see your point, thank you for explaining it.
- tptacek 8y agoYou don't have to verify that your hostname matches the cert. The browser does that for you. That's part of the point.
- craftyguy 8y agoNot all browsers do that, and many major ones display a warning that users have been trained to click through because of at least a decade of similar browser warnings.
- mcpherrinm 8y agoWhat browsers do not?
- idlewords 8y agoI believe there's an additional moving part in the U2F standard (channel ID) that is supposed to mitigate even if someone with a valid cert hijacks the session. But I don't believe it's implemented, and I defer to greater nerds to describe it.