Is there merit, from a security standpoint, in manually resolving the IP addresses for selected trusted sites, bookmarking them, and using them directly, instead of using hostnames?
Benefits that I can see include:
- Resistant to DNS poisoning; as long as the address remains valid, you can keep using it and never know the hostname was poisoned.
- Hidden from standard XSS and CSRF attacks, which target hostnames, because your cookies will be associated with the IP address instead.
- Possibly better security certificate stability on sites that use a different certificate for each of their servers; this is beneficial when using addons like Certificate Patrol and Perspectives.
- Security certificate errors because the hostname doesn't match. However, since you know which hostname should be used, you can manually verify that the certificate matches it.
- Extra work to resolve addresses (eg from the command line), possibly repeated if server addresses change.
- Sites that use name-based virtual hosts won't work.
Obviously this wouldn't be feasible everywhere. But does anyone have any thoughts on whether it's worth doing at all?