4 ms·

Security is not about guaranteeing anything, it's about making it more difficult to break in. The lock on your front door does nothing to guarantee a burglar wo

• yid 14y ago
  Complex proxy?? You mean a headless browser like phantomjs and a slightly higher latency apparent to the client. Hardly difficult, which leads to the false sense of security these images provide. It's made slightly harder on the order of minutes to write a few extra lines of code.
  • nmcfarl 14y ago
    I'm always surprised when I write a scraper/proxy (usually in perl) at how little added latency is involved. If I host the thing on a fat pipe (say an EC2 instance), it's not even noticeable at home.
  • pbreit 14y ago
    It would probably need to be more complex than that if the bank is watching for unexpected activity from individual IP addresses.
  • tghw 14y ago
    The code for the proxy itself isn't that complex, no. But it would have to be tailored to the target's banking site. Again, not extremely complex, but more difficult. And actually implementing the attack, including getting a homographic URL or rouge router, is quite a bit more difficult. Again, the point is that the security image makes the attackers' lives more difficult. The image lends no "false sense of security" because without the image, you'd have the same sense of security.
• rwg 14y ago
  It's more complicated than that. Like physical security, computer security is applied risk management. Your house probably doesn't have solid metal doors, metal bars over the windows, laser tripwires, a patrolling security guard, and angry Doberman Pinschers. All of those things would increase your home's security, but the cost of the security probably doesn't make sense compared to the risks involved with your house getting burgled. Similarly, Hacker News doesn't require client TLS certificates, two-factor authentication, and insanely complex passwords. The risk of horrible and/or costly things happening because someone's HN account got broken into really isn't there, so implementing those security measures doesn't make much sense. Even if the author's bank's security picture doesn't actually decrease fraud at all, the security picture was probably cheap to implement, required minimal user and employee training, and keeps the lawyers and regulators happy. The bank's risk exposure decreases, even if the author's doesn't.
  • vog 14y ago
    > ... the security picture was probably cheap to implement ... Although the implementation might have been cheap, there's another factor to consider: If a system provides a false sense of security, this almost certainly decreases the actual security of the system. And putting effort (no matter how cheap) into something that decreases the overall security - that's not a good idea regarding risk management.
    • tghw 14y ago
      Not having the image provides even less certainty of security. You assume that the image being there will make people less likely to check other aspects of the site, like the URL. But consider the average user. Spoofing and phishing attacks work because people don't check these things. The security image is difficult to spoof and is more likely to clue average users in to attacks. Therefore, it is useful as a security device and is not worse than not having it.
• aptwebapps 14y ago
  No, it really is worse than useless. It is trivial to fetch the image - anyone with a passing familiarity with jQuery can probably do it.
  • Kiro 14y ago
    Maybe I'm missing your point but you can't do cross-domain requests in jQuery (without JSONP) so it would still require a server layer.
    • aptwebapps 14y ago
      Whoops, yes of course. Still pretty easy to setup.
      • davidcuddeback 14y ago
        If doing it from the server side, I think you'll find that you have to answer the user's security questions before you'll be able to scrape the security image and phrase. http://news.ycombinator.com/item?id=5160424 http://news.ycombinator.com/item?id=5160424
        • aptwebapps 14y ago
          The whole point of this kind of man-in-the-middle phishing is that you present a fake page just like the bank's page. Then when they submit whatever it is they have to submit, you do the same via your server and then present them with the next page and so on until you are logged in. More steps are more work for the attacker but that's not a big deal. The issue is that the security image isn't just another layer. It's a layer that the bank is making a guarantee about that it can't back up. They don't say, "Pick a security image to make it slightly harder for phishers." They say, "Pick or upload your own image so that you really know you're on our site."
          • davidcuddeback 14y ago
            You didn't bother to read my other comment that I linked to: "Most people don't see this because they check the "remember this computer" option the first time they login, so even showing the security question so that one can grab the image will seem suspicious to many users."
• KMag 14y ago
  ^this. Also, security images enable other methods for making attackers' lives difficult. Note that forcing proxies to grab the images allows the bank to focus on the IPs that request the highest number of images, or at least block known Tor exit nodes. Sure this forces people running Tor exit nodes to call in, but the percentage is so small that the bank won't care.
• davidcuddeback 14y ago
  To add to that, the security image can potentially raise the barrier a lot more than the author led on. Usually [1], the bank asks you to answer a security question before showing you the personal security image. Most people don't see this because they check the "remember this computer" option the first time they login, so even showing the security question so that one can grab the image will seem suspicious to many users. [1] I just tested this with Ally (the bank shown in the blog post) and I remember it being true with ING Direct. I haven't tested other banks.