3 ms·
This is probably a case where MFA with a Yubikey would help. AFAIK it would choke on the invalid hostname.
by cpach 7y ago
This is probably a case where MFA with a Yubikey would help. AFAIK it would choke on the invalid hostname.
- jrockway 7y agoThe site would just say "for added security, we are requesting your backup code this time."
- potatoz2 7y agoThat may be true, but it's an added opportunity to notice something is wrong. If and when people are used to U2F/Webauthn security, it'll feel very wrong to have to manually enter a code. Although routing information isn't protected either way and is probably fundamentally unsafe.