Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even figure out the right search terms.
As seen on my bank account:
- When I registered, I was asked to pick a phrase that I would remember
- Now, when I log onto my website, the process is as follows:
- I enter my Username and click "next".
- The bank site shows me this phrase. This helps me to be assured that I am actually on my bank's site, and not some fake site set up to steal my login credentials.
- If the pass-phrase matches, I enter my password to complete the authentication process.
- If the pass-phrase doesn't match, I know that either I entered my username wrong or I'm on a phishing site, and I go back to my bank's home page and start over.
In my mind, this sounds like "multi-step authentication". However, when I search for that, I keep getting results for multi-factor authentication - authentication using a token, or two-step authentication as implemented by Google and other sites. While I'm a HUGE proponent of multi-factor authentication using tokens or codes sent to your mobile device, I also want to figure out how to do what my bank is doing.
Is there a name or term for this authentication pattern?