Hacker News Reader

@nly How does this system prevent me from setting up a website that looks like Paypal and giving you the address of my ssh server?

View on HN

It doesn't, but your SSH server wouldn't be able to produce a valid token for Paypal.com.

Btw i'm not liking this SSH solution either, I was just pointing out that's still better than SQRL, which is awful in that it has exactly 1 advantage (it protects users against password reuse) and many nuanced flaws.

Host authentication is a job of SSL though. So you should simply not log-in on a website if it cannot be verified that it is actually Paypal. This holds for both SQRL and passwords and seems to be an independent issue. It also applies to this case because the ssh server is supplied by the website.

Reply on news.ycombinator.com