News for hackers. Stuff that matters.

A comment on “Username or password is incorrect” is bullshit. Parent comment

Re:“Username or password is incorrect” is bullshit by u801e on Friday December 22, 2017 @01:17PM (#15989600)
The spoofing site wouldn't/shouldn't be able to pass the browser validation of the TLS server side certificate.
[ Parent | on HN ]
Re:“Username or password is incorrect” is bullshit by StavrosK on Friday December 22, 2017 @06:55PM (#15991911)
Why not? How hard is it to get a cert for a domain that looks like paypal-businesscenter.com?
[ Parent | on HN ]
Re:“Username or password is incorrect” is bullshit by cjwhite on Saturday December 23, 2017 @12:06PM (#15995027)
Moreover, the browser could remember the expected shared secret based on its and the server's RSA exchange.
[ Parent | on HN ]