Linked Questions

3
votes
2answers
2k views

“Do not enter your password unless you recognize this image” - how does this work? [duplicate]

The login prompt for my student loan repayment site has two parts. You first enter your username, then it shows you an image as well as a password prompt. I picked the image when I first made my ...
4
votes
2answers
789 views

Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]

Possible Duplicate: Effectiveness of Security Images Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on Phishing, ...
0
votes
1answer
1k views

What does showing a “security picture & phrase” guard against? [duplicate]

A couple financial sites that I use have a "security picture" (some small random photo) and "security phrase" (something I write about it). Two of them go about it differently, however: One asks my ...
0
votes
1answer
149 views

Pros and cons of security images [duplicate]

Over the past year or so, I've noticed that all of the banking organizations I work with that have or had "security images" as part of their login process have removed or are planning to remove that ...
1
vote
0answers
88 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...
1
vote
1answer
63 views

Is any security gained from bank issued usernames in this authentication flow? [duplicate]

My Bank's Online Banking feature doesn't use usernames. Instead, they assigned me a digit-only account number*. To log in, I enter my number, then it brings me to a new page to prompt for my password. ...
97
votes
7answers
17k views

Attacker circumventing 2FA. How to defend?

Detailed in the latest NSA dump is a method allegedly used by Russian intelligence to circumvent 2FA. (In this instance Google 2FA with the second factor being a code.) It’s a fairly obvious scheme ...
26
votes
5answers
3k views

Why do “Forgotten Password?” links generally reveal usernames or registered email addresses? [duplicate]

It seems that most sites or systems will just state Invalid username or password As a means to not reveal usernames for use in brute force (and other) attacks. Seems like a good idea as a ...
25
votes
4answers
1k views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
22
votes
1answer
5k views

How do “Confidence images” on my bank's login page improve security?

My bank recently changed their login process to show a preselected image which they label a "Confidence image" - ostensibly to allow a human website user to authenticate the bank's website as not ...
6
votes
4answers
780 views

Banking application login leaks information

My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows: User visits the homepage of the bank. User enters ...