Re:Ask HN: How bad is it to use a self-signed SSL certificate?
by hollerith on Saturday May 31, 2014 @01:45PM
(#7826625)
Yahoo did something very much like that about 5 or 6 years ago: inviting me to upload an image file, then telling me to make sure the image is present every time I log in.
I upload an image file; the next time I found myself at Yahoo's login prompt, the image file was there; the time after that, it was absent. It has not re-appeared since.
Just offering a data point: I don't know enough to have an opinion about the technique.
Re:Ask HN: How bad is it to use a self-signed SSL certificate?
by gburt on Saturday May 31, 2014 @02:48PM
(#7826859)
I thought about this for a second, and what it does do is take an "offline" phishing attack and make it an "online" phishing attack that presumably has logs and can be throttled.
I upload an image file; the next time I found myself at Yahoo's login prompt, the image file was there; the time after that, it was absent. It has not re-appeared since.
Just offering a data point: I don't know enough to have an opinion about the technique.