Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

Why banking websites always ask me to authenticate my PC even after I'd chosen to Remember my PC? This is the case with all banking websites

share|improve this question
I've no idea what you mean by 'verify my PC'. On my baking website I enter my account number, customer number, and PIN and I'm logged in. – Raphael R. Oct 30 '11 at 20:53
5  
Perhaps you have cookies disabled in your browser, or you have your browser set to delete cookies when it is closed. – freedenizen Oct 30 '11 at 20:55
1  
@RaphaelR. verifying PC is a security measure imposed by most online banking websites. If the previous PC you used to access your bank account is different from the PC you're using now. The banking website would ask you to authenticate your new PC. "authenticate" is probably a better word – user22105 Oct 30 '11 at 20:57
You do understand that all "remember my computer" basically amounts to is a cookie right? I know my bank uses a cookie, considering the only time I have provide more then my username and password is when i wipe my cookies. – Ramhound Nov 7 '11 at 19:29

migrated from superuser.com Oct 31 '11 at 23:24

3 Answers

up vote 0 down vote

It remembers you, but it's double-checking to make sure it really is you.

When you click "Remember my PC", it puts a cookie on your computer that remembers your session. However, your current privileges of the session timeout. For example, once you've entered your password, you can probably check your account balance for days. But after a few hours, if you try to withdraw money, you'll have to re-enter your password. That prevents you from walking away from your computer, and having somebody else walk up and withdraw money.

Likewise, if you go to account settings, you can view your mailing address, but if you try to change it, the site will yet again ask you to authenticate.

share|improve this answer
up vote 1 down vote

Financial institutions use patten recognition to 'remember your computer'.

It is similar to licensing schemes where a software license is locked to a specific computer.

Some input that they use to determine identity on your computer is likely not static.

It coule be: a browser cookie, your IP address, the MAC address of your ethernet or WiFi card, your username, the amount of available RAM in your computer, your hard drive serial number, your motherboard model, the id value of your CPU, your operating system version, or any one of a number a things that a financial instution might believe would not chaange on most customer's computers, but does on yours.

share|improve this answer
Do you really mean to say "amount of available RAM" or "amount of total RAM"? 'Cause the former seems like a rather flimsy stat to choose for identity validation. – Iszi Nov 5 '11 at 1:38
@Iszi - He clearly says "amount of available RAM" which certainly would be more unique then the amount of total memory on the system. – Ramhound Nov 7 '11 at 19:32
@Ramhound When I hear "available" I think of "how much RAM is free right now"? "Total" would imply "how much RAM does your system have installed". The latter of these is much less likely to change than the former. If the stat changes regularly, it's no longer useful for identification. – Iszi Nov 7 '11 at 22:25
The web browser you're logging into your bank account with does not have access to most of stats you mentioned, especially your MAC address. That being said, they can log quite a bit including the browser, OS, and IP address you're coming from. More than likely they use cookies in addition to these, though. – John May 8 at 21:24
up vote 3 down vote

An aspect of security which more and more banks are implementing is to try not to trust anything sent by a computer, as an attacker could theoretically change the responses sent to the bank.

Imagine you have authenticated your PC, and an attacker has captured your traffic and has your cookies. If they then try to log on to your account and the bank doesn't ask them to authenticate their PC, that is one less hurdle for them to beat in order to get at your money. So the bank can insist that their cookies are not stored, or that specific ones are wiped on logout.

From a general security perspective, I wouldn't let my PC remember any details from an internet banking site, or in fact any site that could be used to steal sensitive usernames or passwords.

share|improve this answer
I wish! Too many financial institutions believe they can pattern detect 'you'. However for common users more security is usually an annoyance instead of a benefit. – this.josh Nov 4 '11 at 7:57
This sounds like Patco v. Ocean Bank all over again. – Iszi Nov 5 '11 at 1:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.