Is there a best practice for security purposes requiring masking of both User ID and Password for online banking? Is there any rationale for or against masking both?
Best practice says that a username should be something that can be considered public information and thus doesn't need to be protected. The fact that they find the username needs to be protected either means that a) they are doing something counter to best practices that makes it need to be kept secure or b) they are engaging in some security theater to make people feel more secure about their account and possibly make shoulder surfing minimally more difficult.
I can't see how it would give any real benefit as the password is already masked and thus, unless the keys are being logged or the keystrokes recorded. If they are able to get the fully masked password, then they will also be able to get the fully masked username.
One measurable gain I suppose I could see would be if they cache the username. This would mean that if you are accessing your bank account in a public place, the username could be displayed, already entered and masked, such that a shoulder surfer would only be able to get the password and not the username.
The only issue I could think of is someone could bruteforce using the ID he shoulder-surfed. However, your system should implement methods to slow-down these kind of attacks. Therefore, masking only the password should be enough, I'd say it would annoy the user more than anything.
Citi recently added the 'feature' where, after you type in your username and change focus to the next field, it masks the username you entered with * except the first and last two characters. Go ahead and try it, kids, you can view the effect without clicking the 'Sign On' button.
The only rationale I can think of would be to make it harder for someone shoulder-surfing to gather the username (maybe we shouldn't call the masking 'asterisks' but rather 'starbucks'!) It's a very thin increment of security, and I don't feel much more secure for it, but for all I know someone sat and crunched their fraud reports and determined it would have measurable benefit.
I wouldn't say it's best practice; it's either new or obscure, best practices are usually neither. Come ask again in a year and we'll see how it spreads :)
You're essentially looking at the difference between identity and authentication. Your User ID represents your identity, and your password represents your authentication.
The simple truth is that either your authentication mechanism is robust and trustworthy all by itself, or it's not. Keeping the identity secret as a defense against User ID / Password guessing in a feeble attempt to shore up a poor authentication scheme puts an extra burden on your users. If I use my email address as my User ID, are you saying I have to keep my email address a secret? It will likely only confuse your users, who are already feeling that they're in an out-of-control situation with computer security. Instead, follow the Principle of Least Surprise.
If your identity needs to be kept secret for security reasons, there is a failing in the design of your security.
There are valid cases where user identity must be kept secret, and that is for privacy. For example, the HIPAA Title II (Privacy) Act stipulates that your medical information must be kept private. That means that if you buy drugs at the pharmacy, you must prove your identity to the pharmacist, but the pharmacy may not publicly associate your purchase of the drugs with your identity. Your receipt isn't permitted to say "SR HILL" and "ANTIDEPRESSANTS-90 DAYS $150.00". The pharmacy is responsible for securing your sales records (that requires pharmacy security, a different thing.)
But you said "banking", and that's an area where User ID secrecy has often been confused by people as a business requirement. For example, in a bank's account books, your identity is your account number, and since banking has historically done a horrible job of information security, they often don't have a separate authentication step. That means if I know your account number, I can forge it onto a blank check and spend your money. Or if I know your credit card number, I can type it into a web site and spend your money. The entire PCI Data Security industry is built upon these mistakes. But those are the fault of the original insecure design that never segregated identity from authentication. The ID shouldn't need to be secured, but in this case it does.
Improved security practices have fixed most of these kinds of problems. For example, you no longer use the account number as the User ID, and knowing only a User ID doesn't enable me to spend that user's money. In this case there is no need to keep the User ID secret.
Another odd situation is if your User ID represents any other attributes that your clients might wish to keep private. Assume that your schemes are not secret, because they usually aren't. If you prefix your million-dollar client User IDs with "000-" to indicate them to your tellers for red-carpet treatment, as a millionaire client I don't want everyone who sees my ID to know I'm rich. Again, that's a case where the secrecy would be used to cover up an insecure design. Such information should never be revealed until the client is authenticated.