3

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But the results have baffled me.

In incognito mode, the bank asks me for a two-factor code every single time. This didn't surprise me because incognito mode doesn't have any cookies, so I would expect it to prompt me.

In normal mode, I went into "Clear browsing data" and cleared away all cookies, cached files, app data, passwords, download history. I cleared EVERYTHING. I browsed to the bank site, logged in and....NO two factor code prompted.

I repeated this many times, with the same results. My guess is they are doing some kind of advanced browser fingerprinting -- something more complicated than cookies. What do you guys think is going on?

Improve this question
5
  • 1
    It sounds like you didn't successfully clear your cookies. Assuming you're using Chrome, what happens when you open developer tools (F12) > Resources > Cookies > select domain. Are there any cookies listed on the right after you clear your cookies and reload the page?
    – thexacre
    Jul 25, 2015 at 23:07
  • 1
    It's possible your bank is using another method to store data that clearing your browsing data doesn't clear. Something like the evercookie (samy.pl/evercookie). Verizon and other providers did this until recently to track you.
    – user79537
    Jul 25, 2015 at 23:09
  • In the developer tools, the cookies are gone once I delete them. I know that I deleted the cookies successfully.
    – satnam
    Jul 25, 2015 at 23:14
  • 1
    Also in the resources tab in developer tools, is there any data left in any of the other sections besides cookies? Such as Local Storage or IndexedDB?
    – thexacre
    Jul 25, 2015 at 23:38
  • i think its a browser leaks with webrtc check if your webrtc enabled or not browserleaks.com/webrtc WebRTC exposes your internal network IP through allows JavaScript to access your local IP, without user interaction this addon on firefox addons.mozilla.org/en-US/firefox/addon/… can disable webrtc then check again .
    – auth private
    Jul 25, 2015 at 23:52

1 Answer 1

Reset to default
2

I know several banks use "profiling data" from previous logins in order to try to determine the identity of the user based on:

  1. Credentials (obviously)
  2. Secret question (not all banks use this method though)
  3. IP address (Geo Location + time zone) and internet provider

  4. The device(s) previously used to communicate with the bank:

    a. Type of web browser, its cookies, plug-ins & add-ons

    b. Screen resolution

    c. Browser dimensions

  5. Timestamps range: Within what range a user generally logs in.

There are more factors than the above list but it is basically a risk engine that determines when two factor authentication should be triggered or not.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .