3 ms·

No, it really is worse than useless. It is trivial to fetch the image - anyone with a passing familiarity with jQuery can probably do it.

Kiro 14y ago
Maybe I'm missing your point but you can't do cross-domain requests in jQuery (without JSONP) so it would still require a server layer.
- aptwebapps 14y ago
  Whoops, yes of course. Still pretty easy to setup.
  - davidcuddeback 14y ago
    If doing it from the server side, I think you'll find that you have to answer the user's security questions before you'll be able to scrape the security image and phrase. http://news.ycombinator.com/item?id=5160424 http://news.ycombinator.com/item?id=5160424
    - aptwebapps 14y ago
      The whole point of this kind of man-in-the-middle phishing is that you present a fake page just like the bank's page. Then when they submit whatever it is they have to submit, you do the same via your server and then present them with the next page and so on until you are logged in. More steps are more work for the attacker but that's not a big deal. The issue is that the security image isn't just another layer. It's a layer that the bank is making a guarantee about that it can't back up. They don't say, "Pick a security image to make it slightly harder for phishers." They say, "Pick or upload your own image so that you really know you're on our site."
      - davidcuddeback 14y ago
        You didn't bother to read my other comment that I linked to: "Most people don't see this because they check the "remember this computer" option the first time they login, so even showing the security question so that one can grab the image will seem suspicious to many users."
        aptwebapps 14y ago
        I did read it, but I didn't address it directly enough. Is seems like there a few red herrings popping up in this conversation. Homographic urls, for example. Similarly, if users are used to being logged in, or recognized, due to the presence of a cookie in their browser, then, yes, they are going to see something different. But that can hold true regardless of whether security images are used or not. What a phisher can do is emulate the 'clean' state. Not logged in, no cookie. Some users will get suspicious and leave the site, sure. It's like a sales funnel, you don't have to convert every visit to make money. My problem with security images is not that they would never do any good, but that they will do more harm than good. They basically make a promise that they can't keep. To deal more specifically with your example: I'm not sure what the most prevalent system is but the default one described doesn't involve an extra security question. The image is presented after the user enters their username but before they are asked for their password. If the site follows this flow, then we have a problem. Now in your case the flow is a little different. It seems to me that showing users a different page based on a cookie is a good idea in that if a user hits the no-cookie version, they might be alerted. But the good part doesn't have anything to do with security images. As others have posted, the real value of security images is not their security. It's marketing and compliance.
        davidcuddeback 14y ago
        > What a phisher can do is emulate the 'clean' state. Not logged in, no cookie. Some users will get suspicious and leave the site, sure. Agreed. Where we disagree seems to be regarding what constitutes "some" users. I contend that it's a large enough portion of the total that the security images do more good than harm. I admit that my position is based on intuition. If you have evidence to the contrary, please share it. (That's not meant to be snarky. I really would prefer basing my position on evidence than intuition.) > I'm not sure what the most prevalent system is but the default one described doesn't involve an extra security question. The image is presented after the user enters their username but before they are asked for their password. If the site follows this flow, then we have a problem. Now in your case the flow is a little different. I don't know what's most prevalent either. As I mentioned in my other comment, I've sampled too few banks to draw a conclusion, but 100% of the ones I've looked at ask a security question to register your computer before showing the security image. There's a chance I got lucky in the few that I sampled and the rest don't ask a security question, in which case, you'd be right---it'd be trivial to defeat in that case. I just don't see any evidence that that's true. What do you mean by "the default one described?" Do you mean the one described in the blog post? If so, the screen shot in the blog post is from Ally Bank's website, which is one of the banks that I confirmed does ask a security question before displaying the security image. > It seems to me that showing users a different page based on a cookie is a good idea in that if a user hits the no-cookie version, they might be alerted. But the good part doesn't have anything to do with security images. The cookied version of a page must sufficiently unique per user. Otherwise the phisher could emulate the cookied version of the page. You haven't proposed an alternative to the security images, so I'm not sure what you're suggesting here. > As others have posted, the real value of security images is not their security. It's marketing and compliance. This is just an appeal to cynicism and doesn't add to the debate.
tghw 14y ago
How is it worse? And how exactly do you plan on serving the image to the user? Do you have a rouge router? Or a homographic URL? And consider, if you do have either of those things, then you can do so much more than spoofing an image, like reading all traffic, including SSL.
- aptwebapps 14y ago
  Hold on a second, we're just talking about security images, not debating the whole phishing paradigm. Which would be futile, by the way, because phishing happens all the time - sometimes with homographic urls, sometimes without. As for rogue routers in the rest, you don't need that kind of thing at all. Most phishing is just getting gullible people to click on links in their inbox. While it's true that adding security images will make the phisher's job a little harder (and yes, you will need a server but then the phisher is serving this page up somewhere already) it doesn't add that much work. And now you have a situation where you've told your users: "If you don't see the image, it's not secure. If you do see the image, you're in the clear!" You're completely undermining them. Don't you think a user is going to look at things a lot less critically if they see their pet dog or whatever staring back at them? That's why it's worse. It creates a small amount of extra work for phishers, but once they've done that, they are in a much better position. It's like a bad gambit in chess.

Kiro 14y ago

Maybe I'm missing your point but you can't do cross-domain requests in jQuery (without JSONP) so it would still require a server layer.

aptwebapps 14y ago
Whoops, yes of course. Still pretty easy to setup.
- davidcuddeback 14y ago
  If doing it from the server side, I think you'll find that you have to answer the user's security questions before you'll be able to scrape the security image and phrase. http://news.ycombinator.com/item?id=5160424 http://news.ycombinator.com/item?id=5160424
  - aptwebapps 14y ago
    The whole point of this kind of man-in-the-middle phishing is that you present a fake page just like the bank's page. Then when they submit whatever it is they have to submit, you do the same via your server and then present them with the next page and so on until you are logged in. More steps are more work for the attacker but that's not a big deal. The issue is that the security image isn't just another layer. It's a layer that the bank is making a guarantee about that it can't back up. They don't say, "Pick a security image to make it slightly harder for phishers." They say, "Pick or upload your own image so that you really know you're on our site."
    - davidcuddeback 14y ago
      You didn't bother to read my other comment that I linked to: "Most people don't see this because they check the "remember this computer" option the first time they login, so even showing the security question so that one can grab the image will seem suspicious to many users."
      - aptwebapps 14y ago
        I did read it, but I didn't address it directly enough. Is seems like there a few red herrings popping up in this conversation. Homographic urls, for example. Similarly, if users are used to being logged in, or recognized, due to the presence of a cookie in their browser, then, yes, they are going to see something different. But that can hold true regardless of whether security images are used or not. What a phisher can do is emulate the 'clean' state. Not logged in, no cookie. Some users will get suspicious and leave the site, sure. It's like a sales funnel, you don't have to convert every visit to make money. My problem with security images is not that they would never do any good, but that they will do more harm than good. They basically make a promise that they can't keep. To deal more specifically with your example: I'm not sure what the most prevalent system is but the default one described doesn't involve an extra security question. The image is presented after the user enters their username but before they are asked for their password. If the site follows this flow, then we have a problem. Now in your case the flow is a little different. It seems to me that showing users a different page based on a cookie is a good idea in that if a user hits the no-cookie version, they might be alerted. But the good part doesn't have anything to do with security images. As others have posted, the real value of security images is not their security. It's marketing and compliance.
        davidcuddeback 14y ago
        > What a phisher can do is emulate the 'clean' state. Not logged in, no cookie. Some users will get suspicious and leave the site, sure. Agreed. Where we disagree seems to be regarding what constitutes "some" users. I contend that it's a large enough portion of the total that the security images do more good than harm. I admit that my position is based on intuition. If you have evidence to the contrary, please share it. (That's not meant to be snarky. I really would prefer basing my position on evidence than intuition.) > I'm not sure what the most prevalent system is but the default one described doesn't involve an extra security question. The image is presented after the user enters their username but before they are asked for their password. If the site follows this flow, then we have a problem. Now in your case the flow is a little different. I don't know what's most prevalent either. As I mentioned in my other comment, I've sampled too few banks to draw a conclusion, but 100% of the ones I've looked at ask a security question to register your computer before showing the security image. There's a chance I got lucky in the few that I sampled and the rest don't ask a security question, in which case, you'd be right---it'd be trivial to defeat in that case. I just don't see any evidence that that's true. What do you mean by "the default one described?" Do you mean the one described in the blog post? If so, the screen shot in the blog post is from Ally Bank's website, which is one of the banks that I confirmed does ask a security question before displaying the security image. > It seems to me that showing users a different page based on a cookie is a good idea in that if a user hits the no-cookie version, they might be alerted. But the good part doesn't have anything to do with security images. The cookied version of a page must sufficiently unique per user. Otherwise the phisher could emulate the cookied version of the page. You haven't proposed an alternative to the security images, so I'm not sure what you're suggesting here. > As others have posted, the real value of security images is not their security. It's marketing and compliance. This is just an appeal to cynicism and doesn't add to the debate.

tghw 14y ago

How is it worse? And how exactly do you plan on serving the image to the user? Do you have a rouge router? Or a homographic URL? And consider, if you do have either of those things, then you can do so much more than spoofing an image, like reading all traffic, including SSL.

aptwebapps 14y ago
Hold on a second, we're just talking about security images, not debating the whole phishing paradigm. Which would be futile, by the way, because phishing happens all the time - sometimes with homographic urls, sometimes without. As for rogue routers in the rest, you don't need that kind of thing at all. Most phishing is just getting gullible people to click on links in their inbox. While it's true that adding security images will make the phisher's job a little harder (and yes, you will need a server but then the phisher is serving this page up somewhere already) it doesn't add that much work. And now you have a situation where you've told your users: "If you don't see the image, it's not secure. If you do see the image, you're in the clear!" You're completely undermining them. Don't you think a user is going to look at things a lot less critically if they see their pet dog or whatever staring back at them? That's why it's worse. It creates a small amount of extra work for phishers, but once they've done that, they are in a much better position. It's like a bad gambit in chess.