Are there any other ways of verifying the web server you're visiting is actually the correct one?
For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing site that took it's place; then they would be none the wiser.

I know SSL does this already. But are there any ways that don't involve the use of SSL?

3 Answers 3


There's nothing out of the box besides SSL that does this, if you were a web developer you could address it programatically by designing in a verification mechanism that would communicate to specifically designed client software, or maybe a browser plug-in. This seems like quite a bit of work when SSL already does the same thing.

  • 1
    Even if you built something from scratch, you would still the problem of having a proper trust chain built into the client in a safe way.
    – Stephane
    Nov 20, 2013 at 11:04

There have been attempts to do this without encryption and they are as useless as you might expect and susceptible to MiTM attacks. Remember those "if you don't see the picture you set up, don't proceed? Well, nothing to stop the MiTM from just passing through the image.

We added the ability for our software tokens to validate an SSL cert for the user, essentially improving the SSL process and combining it with an OTP. While it may be overkill for what you want to do, it is available in our open-source Community Edition. Info here: http://www.wikidsystems.com/learn-more/technology/mutual_authentication.


Nope, SSL was specifically designed to tackle this problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.