Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any other ways of verifying the web server you're visiting is actually the correct one?
For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing site that took it's place; then they would be none the wiser.

I know SSL does this already. But are there any ways that don't involve the use of SSL?

share|improve this question
up vote 7 down vote accepted

There's nothing out of the box besides SSL that does this, if you were a web developer you could address it programatically by designing in a verification mechanism that would communicate to specifically designed client software, or maybe a browser plug-in. This seems like quite a bit of work when SSL already does the same thing.

share|improve this answer
Even if you built something from scratch, you would still the problem of having a proper trust chain built into the client in a safe way. – Stephane Nov 20 '13 at 11:04

There have been attempts to do this without encryption and they are as useless as you might expect and susceptible to MiTM attacks. Remember those "if you don't see the picture you set up, don't proceed? Well, nothing to stop the MiTM from just passing through the image.

We added the ability for our software tokens to validate an SSL cert for the user, essentially improving the SSL process and combining it with an OTP. While it may be overkill for what you want to do, it is available in our open-source Community Edition. Info here:

share|improve this answer

Nope, SSL was specifically designed to tackle this problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.