4 ms·
My bank used to show me a picture that I specified, after I put in my username, but before I put in my password. I knew that if I was being shown an odd picture
by dfxm12 5y ago
My bank used to show me a picture that I specified, after I put in my username, but before I put in my password. I knew that if I was being shown an odd picture, I either typed in my username incorrectly, or I was not logging into my bank!
I think would make scams more obvious, even in the face of MFA fatigue!
- joshuaissac 5y agoYahoo used to do this, called Yahoo! Sign-In Seal. Not sure if they still do it.
- Nextgrid 5y agoSurely an attacker can just proxy this? Seems like security theatre to me.
- motoboi 5y agoThis is for phishing attacks with lookalike domains and sites. Pretty common in the web banking world.
- Nextgrid 5y agoYes but I'm pretty sure the lookalike domain proxy your username and the "security picture" back to the real domain to make it look legitimate.
- tialaramex 5y agoThe software to do it is even available on GitHub IIRC. Purely for research purposes of course. We know how to actually fix this, apparently people don't want to :(
- jakub_g 5y agoYep. This is kinda useful as an indicator whether you wrote login correctly (wrong pic = wrong login) and to weed out the lowest quality phishing, but for anyone who's not a clown it should be easy to recreate the flow and hence, it's actually even harmful (you think you get assurance you're not scammed while getting scammed). Edit: one thing to make it more bulletproof would be bank rejecting all calls that look like serverish initiated (AWS etc), then the attacker would need some genuinely looking botnet to not get blocked by the bank due to suspicious volume from same IP pool. Raises the bar for attack, but still, serious attacker can mitigate this.
- aaronharnly 5y agoThey only show the picture after you have logged in successfully from the device. If it is a new device (or attacker), the picture is blank and the site says something like “first time using this device?” So it helps against phishing or a MITM that doesn’t intercept the real site cookies.
- banana_giraffe 5y agoGenerally the attack vector is much easier: Just replace the image with a "This service is currently being upgraded for your safety!" or whatever. Most people in studies I've seen will still go through with the login.
- cube00 5y agoAnyone remember which set of keys they had? https://security.stackexchange.com/questions/41247/changing-picture-as-characters-entered-into-password https://security.stackexchange.com/questions/41247/changing-...
- deleted 5y ago[deleted]