Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen BoA do this when I sign in under a different browser on the same computer. If I clear the browser cache, though, they don't ask me again.

How does Bank of America (likely) uniquely identify the computer I'm using to sign in?

I'm asking because I think it might be a good idea to implement a similar security measure on my websites.

share|improve this question
    
It's possible that the site makes a hash of your computer's IP address, and it is checked against a stored list of hashes associated with your account/profile (which are kept on BoA's auth. servers). Especially if clearing your cookies didn't reset things. –  acolyte May 6 '13 at 18:03
add comment

1 Answer

up vote 5 down vote accepted

I'm willing to bet that they don't actually identify the computer, they just send you a persistent cookie once you've successfully logged in, and as long as your browser returns that cookie, they know it's a previously used machine.

You should be able to test this quite easily using something like Firefox's Web Developer toolbar which will let you both examine all of the cookies that you're sending to a specific domain, and will let you delete the cookies for a specific domain. If you delete the cookies for the Bank of America website and then try to login again, you should get the "You're using a new computer" workflow again if indeed they are using a cookie to determine which workflow should be presented to you.

Besides cookies, there are a number of methods they could be using to recognize your machine.

Additionally, the storage mechanisms can be combined (as it appears Bank of America does, or at least did at one point.) The ultimate example of this, so far, is a project known as evercookie which aims to make persistent browser tracking as difficult to defeat as possible.

share|improve this answer
    
I've clear my cookies and it doesn't re-prompt me. Cookies was my first thought too, but that rules it out. –  John May 6 '13 at 16:54
    
@John A bit more research suggests that you might need to clear both your cookies and locally shared objects. helpx.adobe.com/flash-player/kb/… From this answer on SO: stackoverflow.com/a/33319/321790 –  Xander May 6 '13 at 17:01
    
Thanks, Xander. The linked question with the LSO piece helped to clarify things. –  John May 6 '13 at 18:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.