3 ms·

> The images give you as a user a sense of situational awareness -- I know based on the picture which of a half dozen accounts I have (personal, Ira, business,

by peeters 14y ago

> The images give you as a user a sense of situational awareness -- I know based on the picture which of a half dozen accounts I have (personal, Ira, business, etc) I'm logging into. Cool you found a use for them, but that's not why they're there. Almost always when you're being asked to choose one, it's "for your security..." > They also make it more difficult to misdirect people to a lookalike site via phishing. Even old people recognize that their login picture, normally prominently displayed, is missing. First, it's not hard to mirror the interactions of the real site (there's actually a section in the post about sophisticated attacks which addresses this). Second, I doubt very much that old people would notice anything missing, particularly if you masked it as a site redesign/upgrade. I myself am a fairly cautious user, but would I notice if the site for the MasterCard I recently got, which I've logged into maybe 3-4 times and never more than once a month, asked for my username and password up front rather than in a 2-stage format? I honestly doubt I would.

slavak 14y ago
I think old people and the less tech-savvy users are exactly the people who would notice something like this. The less a person understands about computers, the more they rely on habit to use them. My mother calls me to ask what she should do whenever the tiniest change or unexpected balloon pop-up appears. The answer is invariable always the same: "Ignore it". But she calls every time, without fail, regardless. So you might not notice the security image at all. My mother, who's used to her bank website always looking a certain way, will become very concerned when the security image is missing.
- Gigablah 14y ago
  That's exactly how my mother behaves as well. She does online stock trading so she has good reason to be cautious.
sswaner 14y ago
I disagree with your second point. I manage a financial services portal that uses what looks like this same system (from RSA). We deployed it to satisfy regulatory requirements. Any time there is a hiccup in the system (such as RSA's servers going down or slow) we are flooded with calls asking if it is safe to login. Our users are not tech-savvy, and many are 40+.

by peeters 14y ago

slavak 14y ago

I think old people and the less tech-savvy users are exactly the people who would notice something like this. The less a person understands about computers, the more they rely on habit to use them. My mother calls me to ask what she should do whenever the tiniest change or unexpected balloon pop-up appears. The answer is invariable always the same: "Ignore it". But she calls every time, without fail, regardless. So you might not notice the security image at all. My mother, who's used to her bank website always looking a certain way, will become very concerned when the security image is missing.

Gigablah 14y ago
That's exactly how my mother behaves as well. She does online stock trading so she has good reason to be cautious.

sswaner 14y ago

I disagree with your second point. I manage a financial services portal that uses what looks like this same system (from RSA). We deployed it to satisfy regulatory requirements. Any time there is a hiccup in the system (such as RSA's servers going down or slow) we are flooded with calls asking if it is safe to login. Our users are not tech-savvy, and many are 40+.