5

I'm redesigning a login screen for a financial services application. Currently, this requests user ID and password, then (on the same screen) 2 digits from a 6-digit PIN are requested - these 2 digits are only revealed when the user ID and password have been entered.

Looking around at other financial services providers, asking for 2 PIN digits only once other security information has been entered is a fairly common pattern. Are there any significant benefits from this approach compared to asking for all the information on a single screen?

6
  • "only revealed when [...] have been entered". Do you when they are entered on the client side, or submitted to the server? – ndrix Mar 17 '14 at 10:34
  • @m1ke Yes, the 2 digits are only revealed when the user ID and password have been entered client side – Peter Mar 17 '14 at 10:37
  • 1
    Sorry to be such a pain, but can you define "entered". Is there any data submitted to the server? – ndrix Mar 17 '14 at 16:30
  • In every case I've seen, yes, there is a server round trip (observed either through loading a separate page for the PIN digits, or a pause while I think the page is calling the server) – Peter Mar 17 '14 at 19:48
  • For PIN are you talking about a one-time passcode or the user's debit card pin? – Eric G Mar 25 '14 at 16:43
1

Looking around at other financial services providers, asking for 2 PIN digits only once other security information has been entered is a fairly common pattern. Are there any significant benefits from this approach compared to asking for all the information on a single screen?

I'm assuming that the other systems you've looked at only tell you whether any of your details are incorrect after the second step, and do not disclose which part of the credentials were incorrect, which is good.

Yes there are significant benefits, because then the index of the digits are only asked for when it is determined which username it is that is attempting to authenticate.

Say an attacker had somehow got some partial details of an account (e.g. by shoulder surfing). Let's say they know the 2nd and 3rd digits of the PIN.

If the page asked for all the details on one page (username, password and two digits from the PIN), the attacker could simply refresh the page, clearing cookies each time, until the PIN prompt was for the 2nd and 3rd digits of the PIN.

Using the two step approach, the digits asked for can be remembered by the system. e.g. for username "foo" we asked for the 1st and 4th numbers - we will not ask for any others until these have been entered correctly. The system would also have to remember the digits asked for for invalid usernames to prevent a username enumeration attack where different usernames can be tried twice to see if the same digits are requested. You might also want to artificially refresh these digits after a set number of days to simulate a successful login (otherwise an attacker would know that the account is invalid or dormant if it always asked for the same two digits on attempts days apart).

The other approach would be to ask for all the digits of the PIN on the same page, but banks don't like doing this because of shoulder surfing and also phishing sites can easily mimic these pages and capture all information in one go (although I'm not saying that the stepped approach would necessarily prevent these sort of attacks).

1
  • Spot on. To elaborate on that, the system can remember the last X numbers requested and make sure not to repeat those. (Which is basically what you said but the reverse.) – TTT Jun 19 '14 at 21:42
0

I would suggest to let the user enter the user id, password and PIN on the same page. I don't see any security benefits if the user is allowed to enter the PIN only after entering and submitting the correct user id and password combination.

Your method would required to maintain a state after submitting the correct user id and PIN. Something like a session. Once the user has a session the risk is that the user can use the service with this session without providing a PIN due to an implementation error.

Your proposed method adds complexity to the authentication process. Complexity increases the risk of errors. The authentication process should be kept simple to reduce the risk of errors.

The only reason I can think of why some financial services are doing this (PIN after successful user id/password authentication) is usability for the user. If the user has to provide user id, password and PIN in a single step the probability increases that some of the data is wrong. The service is not allowed to tell the user which field was wrong because this would be a hint for an attacker. Thus, the service would tell the user that something is wrong and the user has to check all the fields again. If the PIN is entered in the second step and the user makes an error the user knows that the PIN is not correct.

2
  • There are a few reasons why this is done. It reduces the likelihood that the password gets entered into the username field where it will likely get logged. It takes a little more effort to script a bot to attack the logon process over two pages instead of just one request. Username is first triggered for a sitekey/security image, etc. – Eric G Mar 25 '14 at 16:40
  • Why can't the user enter his password into the username field if the login process consists of two steps? Both, the username and the password are required on the first page. So the user can enter his password into the user field. Second, I think "a little more effort to script a bot" is security through obscurity and doesn't increase security. – DanielE Mar 26 '14 at 8:07
0

I see no benefit in asking for 2 digits from a PIN and a password. It is just two factors that "you know". It doesn't provide an additional factor of authentication and it is a hassle for the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.