noob question: is there not a way for the client to verify that it is actually talking to google.com in a situation like this? I would think there would be some way to verify based on certs or something like that.
There are several other methods that I've seen but they are not bulletproof: - talking directly to hardcoded DNS such as 8.8.8.8 - hardcoding IP addresses into SW - Checking for some obscure header as a part of client/server identification