Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even figure out the right search terms.

As seen on my bank account:

  • When I registered, I was asked to pick a phrase that I would remember
  • Now, when I log onto my website, the process is as follows:
    • I enter my Username and click "next".
    • The bank site shows me this phrase. This helps me to be assured that I am actually on my bank's site, and not some fake site set up to steal my login credentials.
    • If the pass-phrase matches, I enter my password to complete the authentication process.
    • If the pass-phrase doesn't match, I know that either I entered my username wrong or I'm on a phishing site, and I go back to my bank's home page and start over.

In my mind, this sounds like "multi-step authentication". However, when I search for that, I keep getting results for multi-factor authentication - authentication using a token, or two-step authentication as implemented by Google and other sites. While I'm a HUGE proponent of multi-factor authentication using tokens or codes sent to your mobile device, I also want to figure out how to do what my bank is doing.

Is there a name or term for this authentication pattern?

share|improve this question
    
yahoo had similar thing... –  amyassin Jan 8 '13 at 12:51

3 Answers 3

up vote 21 down vote accepted

SiteKey is the feature name that many banks call it and should be able to be searched for under that name. It adds minimal if any security. Anything that your server can present to the user, a man in the middle can act as if they were the client and get the same information. SiteKey (which is likely what your bank calls it) is not secure and doesn't add meaningful security.

It can actually be harmful as it may give users a false sense of security and make them ignore otherwise good indicators such as SSL indicators because the "secure" image or phrase is there. My general recommendation is do not use such flawed mechanisms as they can do more harm than good.

share|improve this answer
    
Thank you for that advice. I'm running across similar advice elsewhere now that I know what search term to look for. Your advice is helpful.. I'd vote this up but it doesn't really answer the question, and might make a better comment on the question. –  David Stratton Jan 2 '13 at 16:29
1  
But that is a VERY good point. It is a false sense of security, and it would be child's play to get that image from the live site. –  David Stratton Jan 2 '13 at 16:35
    
I think I'll ask a question that you can put this answer on - it'll be good for future visitors. –  David Stratton Jan 2 '13 at 16:43
1  
It's a bit scary that some of the worst security practices I've seen online come from banks... –  BlueRaja - Danny Pflughoeft Jan 2 '13 at 23:45
1  
Actually, knowledge-based authentication is something a bit different. Knowledge-based authentication is a broad category and refers to the kinds of questions that a bank asks you, to try to verify your identity. BOA's SiteKey is a specific mechanism to try to let you verify that you are talking to BOA. –  D.W. Jan 3 '13 at 4:43

It's called knowledge-based authentication, and it's used to authenticate the remote server. Common authentication tokens are words and pictures.

One point I would make is that it's a bad idea to give out the authentication token only after being given a non-secret piece of information such as a username. An attacker could target a single user by simply putting their username into the page, or even via an iframe or similar remote fetching mechanism. Instead, it's best to ask the user to provide a weak authentication token (e.g. 4-digit pin), then provide the secret, then ask for the strong authentication token (e.g. password). This makes the mechanism much safer.

share|improve this answer
    
Thank you, and thank you for the additional advice! –  David Stratton Jan 2 '13 at 14:29
2  
The entire approach is useless pseudo-security even if you require a weak token first. It is meant to allow users to detect phishing sites, and it cannot do that. The phishing site can always just relay the information it got, and relay back to the user the correct "knowledge". Sure, it requires a bit more effort from the phisher, but if you use indexed TANs or similar, they need to do this anyways. –  Jan Schejbal Jan 2 '13 at 16:28
1  
@Polynomial - that assumes that the phishing site goes directly. It wouldn't be that hard to setup a relay on a botnet to get the page from a variety of different IPs so as to appear like a client while masking the IP of the phishing site. It is an additional step, but it still amounts to security through obscurity. –  AJ Henderson Jan 2 '13 at 17:10
1  
According to Wikipedia page the term "Knowledge based authentication" seems to be used for "secret question" schemes, not the one OP asked. –  ssg Jan 2 '13 at 18:15
1  
Actually, knowledge-based authentication is something a bit different. Knowledge-based authentication is a broad category and refers to the kinds of questions that a bank asks you, to try to verify your identity. BOA's SiteKey is a specific mechanism to try to let you verify that you are talking to BOA. –  D.W. Jan 3 '13 at 4:43

It is called SiteKey. But recently a Harvard study found SiteKey 97% ineffective. SiteKey is susceptible to the man-in-the-middle attack. SiteKey offers a false sense of security. I would advice you to go for dual factor authentication , which is authentication in the real sense.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.