Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You have to know more than if the page is HTTPS. I could put a fake facebook page on https://evil.example.com. Normal users could go to it, see the HTTPS icon, see that it looks the same as the facebook login page, and think everything is OK.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: