What is this authentication method/approach called?

Question

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even figure out the right search terms.

As seen on my bank account:

• When I registered, I was asked to pick a phrase that I would remember
• Now, when I log onto my website, the process is as follows:
  • I enter my Username and click "next".
  • The bank site shows me this phrase. This helps me to be assured that I am actually on my bank's site, and not some fake site set up to steal my login credentials.
  • If the pass-phrase matches, I enter my password to complete the authentication process.
  • If the pass-phrase doesn't match, I know that either I entered my username wrong or I'm on a phishing site, and I go back to my bank's home page and start over.

In my mind, this sounds like "multi-step authentication". However, when I search for that, I keep getting results for multi-factor authentication - authentication using a token, or two-step authentication as implemented by Google and other sites. While I'm a HUGE proponent of multi-factor authentication using tokens or codes sent to your mobile device, I also want to figure out how to do what my bank is doing.

Is there a name or term for this authentication pattern?

Answer 1

SiteKey is the feature name that many banks call it and should be able to be searched for under that name. It adds minimal if any security. Anything that your server can present to the user, a man in the middle can act as if they were the client and get the same information. SiteKey (which is likely what your bank calls it) is not secure and doesn't add meaningful security.

It can actually be harmful as it may give users a false sense of security and make them ignore otherwise good indicators such as SSL indicators because the "secure" image or phrase is there. My general recommendation is do not use such flawed mechanisms as they can do more harm than good.

Answer 2

It's called knowledge-based authentication, and it's used to authenticate the remote server. Common authentication tokens are words and pictures.

One point I would make is that it's a bad idea to give out the authentication token only after being given a non-secret piece of information such as a username. An attacker could target a single user by simply putting their username into the page, or even via an iframe or similar remote fetching mechanism. Instead, it's best to ask the user to provide a weak authentication token (e.g. 4-digit pin), then provide the secret, then ask for the strong authentication token (e.g. password). This makes the mechanism much safer.