A couple financial sites that I use have a "security picture" (some small random photo) and "security phrase" (something I write about it). Two of them go about it differently, however: One asks my username/password, then on the next page shows the phrase/photo and asks me some other info (a la "First pet's name"). The other just asks my username, then on the next page shows phrase/photo and asks for my password.

What sorts of attacks does this guard against? If someone was making a fake MitM site, couldn't they just forward the phrase/photo, or if they're CSRF just omit them (then does it rely on me to notice that they're not there)?

  • @NeilMcGuigan probably; the extra phrase is probably just a small addition. Feel free to VtC
    – Nick T
    Feb 15, 2016 at 4:34

1 Answer 1


Normally these websites ask for a username/email at login first, then show your security picture prior to asking your password. The picture is chosen by you, the user, from a pool of images during registration. So it basically stops you from giving your password to a malicious clone of a legitimate website because the actual user chosen picture likely won't match the malicious site's image (assuming they try to show you one).

If they do show you one, it is indeed up to you to notice. But that's why they also combine this feature with the security question, which could also be the wrong question or completely missing (which you would also need to notice).

To answer the question of forwarding the photos, accurately forwarding the image/question of a financial site would be nearly impossible. There are two ways to do it that I can think of:

  1. They would need a sizable list of active users and a list of the questions/pictures that correspond to each user, then hope no one changes their security photo or questions at any point. This is something that would basically require access to the financial website's database or a data dump of that database.

  2. The only obvious alternative to that would be finding a vulnerability in the web application that allows them to enumerate users, which most financial websites are going to protect against. They would then need to use some automated technique to create a fairly large list of known users. From there they would have to build a kind of mirror database that links these known users to the security questions and photos.

These are pretty impractical. The most effective way (in my opinion) to thwart security pictures and phrases is either to hope users forget they will be asked, or to get access to their machine and perform key logging or screen grabbing because then there is no reason to set up a phishing website.

  • While you describe how faking these photos from a phishing site would be difficult, you don't answer the OP's question about using a MiTM to fake them. Feb 15, 2016 at 15:57

Not the answer you're looking for? Browse other questions tagged .