4 ms·

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was cre

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

makmanalp 10y ago
Here's some more info on that: http://security.stackexchange.com/questions/19155/effectiveness-of-security-images http://security.stackexchange.com/questions/19155/effectiven...
- BoysenberryPi 10y ago
  That's incredible. Not sure if I underestimated hackers ingenuity or underestimated how gullible people are..
  - emodendroket 10y ago
    I don't know if it's "gullible" so much as not understanding or caring about the feature.
  - throwthisawayt 10y ago
    I don't think it's gullible for a user to proceed when they see a site missing an image, I think it's gullible that an engineer expects that the user would notice without any actual evidence. seems like a cardinal sin of engineering - don't assume your users will behave a certain way.
- mamurphy 10y ago
  As a note, I think many banks have now removed security images. My bank used to have them, and now they don't.
justinpombrio 10y ago
My bank (ING Direct) had that. And then they were bought by Capital One, who removed it.
- theandrewbailey 10y ago
  Did you refuse to sign in without it?
  - justinpombrio 10y ago
    That would have been bad for me but not for the bank. I called them, got a non-answer, and was too apathetic to push harder.
- yitchelle 10y ago
  ING-Diba in Germany is still doing this. Here, I am assuming that ING Direct is the same folks as ING-Diba.
AdmiralAsshat 10y ago
I've run into several websites that use the "security image", and to be honest most of them I don't actually remember what they are until I see them. I can't choose the image myself, so one of them is something banal like a toaster. If I see the toaster, okay, I'm good. But am I 100% certain that if I see a banana instead that I'll say "Something is amiss here!"? I really don't know. On the other hand, if I could upload my own security image for each site, I guarantee I would remember it, because I'd probably use something I drew myself.
- Raphmedia 10y ago
  My bank has security image + security user written sentence. If I don't see a big goofy dog saying "Who's a good boy? [my dog's name] is a good boy!", I know I'm not on the right website.
  - startling 10y ago
    So, what's stopping the wrong site from making those requests to your bank and proxying the image?
    - Tortoise 10y ago
      The bank sets a cookie on your machine and only displays the image if you have the cookie. You won't get the image on a machine you've never used to log in before.
sopooneo 10y ago
Couldn't the hacker just pass on the username that I assume is being used to select the photo on the real site, and then put that image in place on their fake login site?
x0x0 10y ago
But phishers can praxy the 3rd party site to you. And this isn't hard to do. It might help w/ your relatives, but for anything even mildly targeted you can certainly rent a couple t2.nano to pull this off...
ghurtado 10y ago
Yup. Verizon Wireless does this as well.

makmanalp 10y ago

Here's some more info on that: http://security.stackexchange.com/questions/19155/effectiveness-of-security-images http://security.stackexchange.com/questions/19155/effectiven...

BoysenberryPi 10y ago
That's incredible. Not sure if I underestimated hackers ingenuity or underestimated how gullible people are..
- emodendroket 10y ago
  I don't know if it's "gullible" so much as not understanding or caring about the feature.
- throwthisawayt 10y ago
  I don't think it's gullible for a user to proceed when they see a site missing an image, I think it's gullible that an engineer expects that the user would notice without any actual evidence. seems like a cardinal sin of engineering - don't assume your users will behave a certain way.
mamurphy 10y ago
As a note, I think many banks have now removed security images. My bank used to have them, and now they don't.

justinpombrio 10y ago

My bank (ING Direct) had that. And then they were bought by Capital One, who removed it.

theandrewbailey 10y ago
Did you refuse to sign in without it?
- justinpombrio 10y ago
  That would have been bad for me but not for the bank. I called them, got a non-answer, and was too apathetic to push harder.
yitchelle 10y ago
ING-Diba in Germany is still doing this. Here, I am assuming that ING Direct is the same folks as ING-Diba.

AdmiralAsshat 10y ago

I've run into several websites that use the "security image", and to be honest most of them I don't actually remember what they are until I see them. I can't choose the image myself, so one of them is something banal like a toaster. If I see the toaster, okay, I'm good. But am I 100% certain that if I see a banana instead that I'll say "Something is amiss here!"? I really don't know. On the other hand, if I could upload my own security image for each site, I guarantee I would remember it, because I'd probably use something I drew myself.

Raphmedia 10y ago
My bank has security image + security user written sentence. If I don't see a big goofy dog saying "Who's a good boy? [my dog's name] is a good boy!", I know I'm not on the right website.
- startling 10y ago
  So, what's stopping the wrong site from making those requests to your bank and proxying the image?
  - Tortoise 10y ago
    The bank sets a cookie on your machine and only displays the image if you have the cookie. You won't get the image on a machine you've never used to log in before.

sopooneo 10y ago

Couldn't the hacker just pass on the username that I assume is being used to select the photo on the real site, and then put that image in place on their fake login site?

x0x0 10y ago

But phishers can praxy the 3rd party site to you. And this isn't hard to do. It might help w/ your relatives, but for anything even mildly targeted you can certainly rent a couple t2.nano to pull this off...

ghurtado 10y ago

Yup. Verizon Wireless does this as well.