9 ms·
@nly How does this system prevent me from setting up a website that looks like Paypal and giving you the address of my ssh server?
by Sarien 12y ago
@nly How does this system prevent me from setting up a website that looks like Paypal and giving you the address of my ssh server?
- nly 12y agoIt doesn't, but your SSH server wouldn't be able to produce a valid token for Paypal.com. Btw i'm not liking this SSH solution either, I was just pointing out that's still better than SQRL, which is awful in that it has exactly 1 advantage (it protects users against password reuse) and many nuanced flaws.
- Sarien 12y agoHost authentication is a job of SSL though. So you should simply not log-in on a website if it cannot be verified that it is actually Paypal. This holds for both SQRL and passwords and seems to be an independent issue. It also applies to this case because the ssh server is supplied by the website.