1

Financial websites (banks, credit reporting agencies, etc.) often use two stages when authenticating you:

  • Identifier (account number, email, etc.)
  • Two characters from a memorable word

I've noticed that if I fail to authenticate properly (wrong characters, website error) these websites request the exact same combination of characters from your memorable word.

The fact that this policy appears to be widespread hints that this has some security benefit.

What would such benefits to security be (as I can't think of any)?

4

It prevents replay attack. If the attacker manages to intercept the partial memorable word from a number of previous interaction, the attacker can simply refresh the page until they are asked the part of memorable word that they know about. Pinning the part of the memorable word prevents the attacker from doing so.

Note that this is simply a poor man's implementation of OTP. A better implementation to prevent replay attack is to use hardware token, text message, or RFC 6238 compliant TOTP app like Google Authenticator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.