4 ms·
The time honored solution to this is not how you propose- Its called double-stepping and its annoying from a UI perspective. Step 1: Enter your username and cl
by DanBlake 14y ago
The time honored solution to this is not how you propose- Its called double-stepping and its annoying from a UI perspective.
Step 1:
Enter your username and click "go"
Step 2: you are presented with a image you have chosen before- If the image matches, you enter your password and click continue
USBank.com does this, try it by typing in a random name, like cstevens - Notice how it doesnt accept a user + pass on the same screen
- ef4 14y agoDouble stepping is fundamentally weaker from a security perspective. The phisher can present you the username screen, use it to fetch your correct image from Google, and present the image to you. This proposal is better in the sense that the correct image is cached locally and protected by the browser's local storage origin policy.