Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Scammer Used Fake Court Order to Take over Dark Web Drug Market Directory. Parent comment
Multiple domains through multiple registrars seems like the only work around.
You could establish 3 domains for a user to recognize: application.com, application-login.com, and application-announcements.com
Users know to go to the login domain, and know to verify they are sent to application.com.
Users know that all announcements appearing on the login or application domain would also be posted to the announcement domain for verification.
On the login domain you would only enter a username and then be forwarded to a password page on the application domain.
An attacker would have to take control of 2 domains to get your password, and all 3 to intercept payments.
There are no comments on this comment yet.
Multiple domains through multiple registrars seems like the only work around.
You could establish 3 domains for a user to recognize: application.com, application-login.com, and application-announcements.com
Users know to go to the login domain, and know to verify they are sent to application.com.
Users know that all announcements appearing on the login or application domain would also be posted to the announcement domain for verification.
On the login domain you would only enter a username and then be forwarded to a password page on the application domain.
An attacker would have to take control of 2 domains to get your password, and all 3 to intercept payments.