4 ms·

It was Bank of America actually, if we're talking about the same thing. Essentially you chose an avatar photo from a pool of several and then when you typed you

It was Bank of America actually, if we're talking about the same thing. Essentially you chose an avatar photo from a pool of several and then when you typed your username it would display that photo alongside your name to prove to you that you were logging into the real BofA site. I can't remember the exact name they used for this feature and Google is failing me. EDIT: BofA called it SiteKeys. And it looks like they were "useless" according to this article [0]. Someone even wrote a paper on it [1]. Seems several banks actually implemented this concept and then phased it out. [0] https://www.marketwatch.com/story/banks-find-online-security-images-offer-little-protection-2015-11-05 https://www.marketwatch.com/story/banks-find-online-security... [1] https://users.ece.cmu.edu/~lbauer/papers/2014/w2sp2014-securityimages.pdf https://users.ece.cmu.edu/~lbauer/papers/2014/w2sp2014-secur...

mdaniel 4y ago
> And it looks like they were "useless" according to this article [0]. Someone even wrote a paper on it [1]. Seems several banks actually implemented this concept and then phased it out. Okta still does that same trick on their login screens. Since I have several Okta logins, there's no way I would be able to remember which of the 9(?) icons matched with which domain, so I hear you about them being useless. I would be able to spot one of the "wrong" ones, as there are a class of those icons that I would never choose so ... security? :-/
- joveian 4y ago
  Worse than useless, even if you do check the image they can be MITMed and in no way indicate that you are actually on the site you think you are on (they only help against the lowest effort static phishing sites). US banks decided that they would rather address the perception of insecurity rather than improving security. It isn't their money if someone gets scammed. These days I think the best way to be sure you are on the correct site is to have the browser store at least the username/email used for a login and never login if the browser won't fill in that info (often saving the password is a good idea too depending on your situation). I've thought it would be helpful if browsers had a "site bookmark" feature that would show you are on a site you had previously labeled while visiting any page on the site, however I'm not aware of any browser actually doing that. At the OS level a phrase could potentially work since there isn't the same MITM risk, although graphics drivers are complex and there could easily be a bunch of ways the phrase could leak. I wish there was a second small and simple display with at least a couple of buttons for security purposes. Maybe rough for phones but larger devices could do that. Or even two of them, one for communication with the OS and one for accessing credentials. The second could be removable for use with multiple devices. Of course, this comes with accessibility challenges that need to be considered.
- datavirtue 4y ago
  The user should have to supply the image.
jrumbut 4y ago
I thought the downfall of that was they asked you to type a "description" of the image and often showed an image with a single object. So just show one of them and the word for the object and you'll probably be right quite often if the user even notices.

mdaniel 4y ago

> And it looks like they were "useless" according to this article [0]. Someone even wrote a paper on it [1]. Seems several banks actually implemented this concept and then phased it out. Okta still does that same trick on their login screens. Since I have several Okta logins, there's no way I would be able to remember which of the 9(?) icons matched with which domain, so I hear you about them being useless. I would be able to spot one of the "wrong" ones, as there are a class of those icons that I would never choose so ... security? :-/

joveian 4y ago
Worse than useless, even if you do check the image they can be MITMed and in no way indicate that you are actually on the site you think you are on (they only help against the lowest effort static phishing sites). US banks decided that they would rather address the perception of insecurity rather than improving security. It isn't their money if someone gets scammed. These days I think the best way to be sure you are on the correct site is to have the browser store at least the username/email used for a login and never login if the browser won't fill in that info (often saving the password is a good idea too depending on your situation). I've thought it would be helpful if browsers had a "site bookmark" feature that would show you are on a site you had previously labeled while visiting any page on the site, however I'm not aware of any browser actually doing that. At the OS level a phrase could potentially work since there isn't the same MITM risk, although graphics drivers are complex and there could easily be a bunch of ways the phrase could leak. I wish there was a second small and simple display with at least a couple of buttons for security purposes. Maybe rough for phones but larger devices could do that. Or even two of them, one for communication with the OS and one for accessing credentials. The second could be removable for use with multiple devices. Of course, this comes with accessibility challenges that need to be considered.
datavirtue 4y ago
The user should have to supply the image.

jrumbut 4y ago

I thought the downfall of that was they asked you to type a "description" of the image and often showed an image with a single object. So just show one of them and the word for the object and you'll probably be right quite often if the user even notices.