Currently our signature challenge screen as presented by 3Box does not show the requesting domain, so if I'm looking at another domain while the challenge pops up, I might think it's coming from them, which could be used to mitm the 3box secret material.