Skip to main content
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link

There could be a number of non-technical reasons, possibly a driver would be performance because it reduces load to some processing on the backend that doesn't need to get called.

Another possibility may be to make it harder to setup a phishing website. You now need to program multiple pages. Also, if you only show OTP when there is a successful username+password (something you know authentication) it can make it hard to create the phishing site and provides more pages for the user to notice. Security images are often known as being of minimal value because the process is often username, then show security image (e.g. SiteKey), then password. However, if you only change this with two-factor to be username->password->security image->OTP this makes creating a phishing site more complex, though still not impossible since the phishing site can emulate a user session to the real site with the username and password.

The following questions address spreading out a logon over multiple pages in general:

There could be a number of non-technical reasons, possibly a driver would be performance because it reduces load to some processing on the backend that doesn't need to get called.

Another possibility may be to make it harder to setup a phishing website. You now need to program multiple pages. Also, if you only show OTP when there is a successful username+password (something you know authentication) it can make it hard to create the phishing site and provides more pages for the user to notice. Security images are often known as being of minimal value because the process is often username, then show security image (e.g. SiteKey), then password. However, if you only change this with two-factor to be username->password->security image->OTP this makes creating a phishing site more complex, though still not impossible since the phishing site can emulate a user session to the real site with the username and password.

The following questions address spreading out a logon over multiple pages in general:

There could be a number of non-technical reasons, possibly a driver would be performance because it reduces load to some processing on the backend that doesn't need to get called.

Another possibility may be to make it harder to setup a phishing website. You now need to program multiple pages. Also, if you only show OTP when there is a successful username+password (something you know authentication) it can make it hard to create the phishing site and provides more pages for the user to notice. Security images are often known as being of minimal value because the process is often username, then show security image (e.g. SiteKey), then password. However, if you only change this with two-factor to be username->password->security image->OTP this makes creating a phishing site more complex, though still not impossible since the phishing site can emulate a user session to the real site with the username and password.

The following questions address spreading out a logon over multiple pages in general:

Source Link
Eric G
  • 9.8k
  • 5
  • 35
  • 61

There could be a number of non-technical reasons, possibly a driver would be performance because it reduces load to some processing on the backend that doesn't need to get called.

Another possibility may be to make it harder to setup a phishing website. You now need to program multiple pages. Also, if you only show OTP when there is a successful username+password (something you know authentication) it can make it hard to create the phishing site and provides more pages for the user to notice. Security images are often known as being of minimal value because the process is often username, then show security image (e.g. SiteKey), then password. However, if you only change this with two-factor to be username->password->security image->OTP this makes creating a phishing site more complex, though still not impossible since the phishing site can emulate a user session to the real site with the username and password.

The following questions address spreading out a logon over multiple pages in general: