Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Are there any other ways of verifying the web server you're visiting is actually the correct one?
For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing site that took it's place; then they would be none the wiser.
I know SSL does this already. But are there any ways that don't involve the use of SSL?
There's nothing out of the box besides SSL that does this, if you were a web developer you could address it programatically by designing in a verification mechanism that would communicate to specifically designed client software, or maybe a browser plug-in. This seems like quite a bit of work when SSL already does the same thing.
There have been attempts to do this without encryption and they are as useless as you might expect and susceptible to MiTM attacks. Remember those "if you don't see the picture you set up, don't proceed? Well, nothing to stop the MiTM from just passing through the image.
We added the ability for our software tokens to validate an SSL cert for the user, essentially improving the SSL process and combining it with an OTP. While it may be overkill for what you want to do, it is available in our open-source Community Edition. Info here: http://www.wikidsystems.com/learn-more/technology/mutual_authentication.
Nope, SSL was specifically designed to tackle this problem.
