2 ms·
> Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied. It can, simple as that.
by edent 6y ago
> Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied.
It can, simple as that. Some make it moderately more difficult by showing you, say, 9 pictures and asking you to pick the one that's yours. But, again, dead easy to proxy.
- isbvhodnvemrwvn 6y agoOthers also ask you to put in only some characters of your password, which is even more troubling because at best they hash them in various configurations when you change password, at worst - they keep it in plaintext.
- jameshart 6y agoThe original version of this pattern relied on local storage on your device to ensure that only the real site or app could show you the right image.
- bombcar 6y agoThat makes a lot more sense - I wonder if any are left that do it.