I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But the results have baffled me.
In incognito mode, the bank asks me for a two-factor code every single time. This didn't surprise me because incognito mode doesn't have any cookies, so I would expect it to prompt me.
In normal mode, I went into "Clear browsing data" and cleared away all cookies, cached files, app data, passwords, download history. I cleared EVERYTHING. I browsed to the bank site, logged in and....NO two factor code prompted.
I repeated this many times, with the same results. My guess is they are doing some kind of advanced browser fingerprinting -- something more complicated than cookies. What do you guys think is going on?