3 ms·

It does sort of involve crypto: if the page you control weren't served over HTTPS it wouldn't be too hard (DNS poisoning) for someone else to trick a server int

by jefftk 4y ago

It does sort of involve crypto: if the page you control weren't served over HTTPS it wouldn't be too hard (DNS poisoning) for someone else to trick a server into verifying the wrong user.

account42 4y ago
If DNS poisoning is so easy why don't you perform the same attach on Let's Encrypt since that also uses plain HTTP.
- jefftk 4y ago
  Certificate Authorities are extremely careful about DNS (and BGP hijacking), more so than basically everyone else.