One potential way to solve this would be to include the origin in the challenge, which the server could check:<p><pre><code>    ssh demo-ssh.bob.com -l 7d7662f63f70de7714 -p 2222 https:&#x2F;&#x2F;www.bob.com
</code></pre>
Mallory&#x27;s attack then would have the possibility of being detected:<p><pre><code>    ssh demo-ssh.mallory.net -l 7d7662f63f70de7714 -p 2222 https:&#x2F;&#x2F;www.bob.com
</code></pre>
However, this still relies on the user manually checking the origin of the challenge every single time, and users aren&#x27;t very reliable.  It might be better suited to a browser extension than to a manual copy-and-paste process.