The whole SiteKey/tiger image solution only gives you an illusion of the solution. What happens when the system displays "System error, unable to display the image?" How will a convincingly-written error message prevent your average gullible or below-average competence computer user from logging in to a phishing site?
Think of how many things can go wrong on a computer. Think of every time when someone asked you why something works one way in this situation, but another way in another situation, and you had to use a technical explanation (excuse, really) for that inconsistency. Computing is full of that. Until we get to a place where people can actually TRUST and expect consistent behavior in their computing devices, the SiteKey/tiger will be well circumventable.
As far as I'm concerned, SiteKey is a brilliant business idea for selling to satisfy the regulatory two-factor requirement, but a terrible idea in practice.
Frankly, I believe it's not something you can make happen. I remember a story here not long ago about honeypots in China and businessmen getting full briefing and warnings by the MI5 before leaving the UK and some would still leave their computers and smartphones powered on near the bed. I think it's the same with some users: they just don't learn and never will (I have another theory that states they don't want to learn anything about computers and that it should magically read their minds but I always end up cursing when I try to explain it and besides it's not the point :).
Unless of course they're adult diapers for the discerning (and ageing) security professional.
Username: ____
Password: ____
Please note that as of June 7th 2012 the system prompt
image identification system has been deprecated and
being replaced with new security measures.
If you have any questions or require assistance, contact
technical support at [email protected]
Some fairly large banks here in Norway have at times ran with a not-completely-valid SSL certificate - making the bank login indistinguishable from a man-in-the-middle.
Answer from their phone support? "Oh yeah whenever you see that warning, just click 'allow' or 'ignore'."
1. Attacker prompts me (or my grandmother) for login name. 2. Attacker gives login name to bank. 3. Bank serves proper image to attacker. Attacker stores image. 4. Profit.
The parent poster suggested that all system messages have the security message. The user is not prompted for some sort of id first, they're already using the computer and are presumed to be logged in.
This is the right way to use security images, IMO, although they're still not perfect as others in the thread have pointed out. The way you describe, which I believe BoA uses (just hearsay), is bad security.
Security is never about 100% guarantees. It's about reducing the exploitability and impact of weaknesses.
"The user is then presented 10 images (a tiger,
a house, a moose, etc) from a library of 10,000 images."
The question is: are there 10,000 images that are different enough people won't be fooled. Say my picture is a green house. And a prompt has a picture of a red house, will I accidentally think its the right site key?
The good news is most people won't even have a picture of a house as their site key so it will protect a large percent.
1) If the attacker can scrape the screen, they can detect which image you are using - securing the entire pipeline to the screen is hard.
2) 10,000 images is way too few.
Even if we can assume an even distribution of images, as an attacker I can serve the same image to all targets, 1 in 10,000 will now think that they are interacting with a trusted component
For example when I install Windows 8 or Mountain lion one of the first prompts I must address is:
The user is then presented 10 images (a tiger, a house, a moose, etc) from a library of 10,000 images. Next time a user gets a system prompt if the system prompt doesn't have the picture of a tiger they know its a fake prompt.See site key: http://en.wikipedia.org/wiki/SiteKey