Hacker News Reader

> so it can't be fooled by impostor websites, however clever

Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying that the hostname matches the cert... (big assumption)

In any case, I see your point, thank you for explaining it.

View on HN

I believe there's an additional moving part in the U2F standard (channel ID) that is supposed to mitigate even if someone with a valid cert hijacks the session. But I don't believe it's implemented, and I defer to greater nerds to describe it.

You don't have to verify that your hostname matches the cert. The browser does that for you. That's part of the point.

Not all browsers do that, and many major ones display a warning that users have been trained to click through because of at least a decade of similar browser warnings.

What browsers do not?

NCSA Mosaic 2.0.0 (and all versions prior).

Probably `M-x eww`.

Reply on news.ycombinator.com