I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps.

For example when I try to login to my Gmail account when I'm abroad it sometimes makes me solve a captcha, or asks me what is the location I usually log-in from.
Another interesting example is when I try to log-in to my Facebook account from abroad, and it shows me pictures of my friends and asks me to identify them before I am granted access to my account.

I assume these measures are taken to protect my account from password theft.

What criteria do web services use to find suspicious activity?

One answer that is obviously derived from the examples above is a log-in attempt from a different country than the one the user usually logs-in from. I'm curious if there are any other techniques, perhaps even ones that are used not only during authentication, but during the rest of the user's activity on the site.

Is there any information available on what techniques various web services are currently using?

1 Answer 1


In addition to the verification methods you've provided, Web services keep track of users using the following methods. Usually a failure in any of these services can cause a site to block access or lock an account.


These are text files that a website will send to your browser when you access a site or service. These files contain information specified by the site for use in things like authentication and recognition. Sometimes they store preferences, other times they may store things like last access time or last IP address. Often this information can be encrypted or encoded in a non-readable method. When a user visits a site, the information on the computer (if it exists) is compared with what they have on file.

Cookies are also useful in catching failed attempts. When a person (UserB) tries to login to a site as UserA the site can present them with a cookie for the username they're trying to use and another one containing the number of logins they've attempted. When they login as UserB and use their own account at a later time, the site can collect the cookies for the previous attempts and then cross-check their records to see if UserA is related to them or aware of the attempt.


When a user accesses a web server they open something called a session. During the session, the browser and the server exchange information in the form of variables and cookies. This information will exist as long as the session is open. Sessions can have a specific timeframe where they are active and they can also be destroyed when someone leaves a website or closes their browser. When a person tries to access a site from a second device using the same logins this will open a new session. Some websites are aware of this and will say something like "You're accessing your site from two locations. If you are NOT accessing this site from multiple locations please contact customer service."

Database Comparison (Location, Device, Activity, Habits)

Some web applications store information about a user, their habits in terms of spending (banks and credit card companies do this), frequency in access, and IP geolocation. When a user accesses a site their stored profile is compared with their current session to see if the user's behavior fits the pattern on record (Location, Device, Duration of access, Etc). An example might be someone logging in from another location where they have never logged in before.

Two-Step Authentication or Verification

Some sites like Google may require you to use an authentication app installed on a mobile device that you have been previously authenticated on or they may require you to check your e-mail account to get a one-time password. This is called two-step or two-stage authentication or verification. When you attempt to log into the site from a new machine or a machine that doesn't have an active session or existing cookie, you'll have to provide information from the second device (usually a cell phone or e-mail) to prove that you are the person who originally setup the account. Sometimes this is also done in the form of an SMS text message.

Timers and Real User Verification

Some sites will use a real user verification scheme like a CAPTCHA to make sure that a user is really a person and not a bot. Websites like banks and some stock photography sites implement other schemes to make sure you're not performing too many tasks at once when you have your session open. If you're reacting more quickly than a human user they may close your session. Additionally they may close your session due to inactivity because they try not to assume that a delay in access means the same user on the same terminal.

Preshared Key Verification

Most websites will provide a user with a password. The user is requested to provide this password when they access the site again.

Challenge and Response

Some sites request information in addition to a password in the form of a challenge and response phrase where a user can authenticate themselves. "Where do you go to School?" "Where were you born?" the answers to these sort of questions are typically not known outside of a user's circle of friends and family. The reason these questions aren't the main questions for authentication are because of things like unfiltered social media where someone can do a web search and find the answers by reading a profile.

  • You should add location. If a bank sees that you have logged in from California, and then sees Romania, they may lock the account.
    – rook
    Aug 17, 2013 at 20:37
  • @Rook I briefly touched on IP geolocation in the database section, but didn't go into it too much. I've added an example mentioning it. Aug 17, 2013 at 21:06
  • +1 Thanks for the detailed answer. However, it includes some information that's irrelevant to the question. For example: how does cookies help the web service detect password theft? If someone stills my password he can log-in to the service and get the authentication cookies just the same, can't he? The information I was looking for is mentioned briefly in the database section (sorry if the question wasn't clear). I would like know with more details what web services take into account when they build the user profile. Is information available on how real web services are currently doing this?
    – Joe
    Aug 18, 2013 at 5:34
  • @Joe Some sites use cookies for detection just the same as they use cookies for authentication. For instance if you've tried to login a couple of times some sites will give you a cookie for the number of login attempts. (Usually they're hashed). Also the cookies help the sites determine if you're a legit user who has accessed the site before. It really depends on the site as to how they do it specifically. Aug 18, 2013 at 17:55
  • @Joe, If they didn't steal your phone and the site uses a two-step verification also the cookies won't help him to login at all but it will tell them that he's the one who was attempting to login when he tries to access a different page on their site and use his own identity. Aug 18, 2013 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .