4 ms·
How does friendface show your cartoon elephant before you enter your username? (hint: it won't) The way this works looking at banking websites is that the user
by emidln 12y ago
How does friendface show your cartoon elephant before you enter your username? (hint: it won't)
The way this works looking at banking websites is that the user enters a username. Then they get some secret image + description that they previously wrote and can enter their password.
- speleding 12y agoIt is a simple man-in-the-middle attack. The proxy will forward the username and echo back whatever it receives from the bank. The reason it might work in this case is because the assumption is that people will only verify the browser bar when they first arrive on the page, and not when they have been "tab nabbed" like this
- alistairSH 12y agoCorrect. Plus, the secret image assumes I actually remember which image I select for every page. Given that none have the same collection of images, I'm likely to have only a vague notion of which one I picked at account creation.
- Bognar 12y agoMost of the banking websites that do this also remember information about your browser and IP. If it's a new computer, you're required to verify the computer before they show you the image.