Timeline for What is this authentication method/approach called?
Current License: CC BY-SA 3.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 25, 2014 at 7:44 | comment | added | AviD♦ | @Polynomial if that were relevant, than any password authentication would be considered KBA. This is not that. | |
| Jan 3, 2013 at 6:48 | comment | added | Polynomial | @D.W. SiteKey is still a type of KBA, since you're authenticating the server based on its knowledge of a secret token. | |
| Jan 3, 2013 at 4:43 | comment | added | D.W. | Actually, knowledge-based authentication is something a bit different. Knowledge-based authentication is a broad category and refers to the kinds of questions that a bank asks you, to try to verify your identity. BOA's SiteKey is a specific mechanism to try to let you verify that you are talking to BOA. | |
| Jan 2, 2013 at 22:53 | comment | added | David Stratton | Sorry, I changed the accepted answer simply because googling "SiteKey" gave me the results I was looking for and "Knowedge Based Authentication" came up with a lot of other stuff with a few of the results I was looking for mixed in. | |
| Jan 2, 2013 at 20:35 | comment | added | Polynomial | @ssg The Wikipedia page focuses on authentication of the client, not the server, but the same concept works both ways. | |
| Jan 2, 2013 at 18:15 | comment | added | Sedat Kapanoglu | According to Wikipedia page the term "Knowledge based authentication" seems to be used for "secret question" schemes, not the one OP asked. | |
| Jan 2, 2013 at 17:10 | comment | added | AJ Henderson | @Polynomial - that assumes that the phishing site goes directly. It wouldn't be that hard to setup a relay on a botnet to get the page from a variety of different IPs so as to appear like a client while masking the IP of the phishing site. It is an additional step, but it still amounts to security through obscurity. | |
| Jan 2, 2013 at 16:44 | comment | added | Polynomial | I do see your point though - it's a minimal security measure, and might be more detrimental in the long run if users end up trusting a phishing site because it had the correct word / image. | |
| Jan 2, 2013 at 16:43 | comment | added | Polynomial | True, but if anti-framing and proper ajax policies are used it makes it difficult. The phishing server would have to fetch it and pass it back to the client, which would quickly give away the IP of the phishing server to the bank. | |
| Jan 2, 2013 at 16:28 | comment | added | Jan Schejbal | The entire approach is useless pseudo-security even if you require a weak token first. It is meant to allow users to detect phishing sites, and it cannot do that. The phishing site can always just relay the information it got, and relay back to the user the correct "knowledge". Sure, it requires a bit more effort from the phisher, but if you use indexed TANs or similar, they need to do this anyways. | |
| Jan 2, 2013 at 14:38 | vote | accept | David Stratton | ||
| Jan 2, 2013 at 22:53 | |||||
| Jan 2, 2013 at 14:26 | history | answered | Polynomial | CC BY-SA 3.0 |