News for hackers. Stuff that matters.

A comment on Signing in to websites with SSH. Parent comment

Re:Signing in to websites with SSH by Sarien on Friday January 30, 2015 @09:51AM (#8972246)
@nly How does this system prevent me from setting up a website that looks like Paypal and giving you the address of my ssh server?
[ Parent | on HN ]
Re:Signing in to websites with SSH by nly on Friday January 30, 2015 @10:07AM (#8972321)
It doesn't, but your SSH server wouldn't be able to produce a valid token for Paypal.com.

Btw i'm not liking this SSH solution either, I was just pointing out that's still better than SQRL, which is awful in that it has exactly 1 advantage (it protects users against password reuse) and many nuanced flaws.

[ Parent | on HN ]
Re:Signing in to websites with SSH by Sarien on Friday January 30, 2015 @11:05AM (#8972640)
Host authentication is a job of SSL though. So you should simply not log-in on a website if it cannot be verified that it is actually Paypal. This holds for both SQRL and passwords and seems to be an independent issue. It also applies to this case because the ssh server is supplied by the website.
[ Parent | on HN ]