> The images give you as a user a sense of situational awareness -- I know based on the picture which of a half dozen accounts I have (personal, Ira, business, etc) I'm logging into.

Cool you found a use for them, but that's not why they're there. Almost always when you're being asked to choose one, it's "for your security..."

> They also make it more difficult to misdirect people to a lookalike site via phishing. Even old people recognize that their login picture, normally prominently displayed, is missing.

First, it's not hard to mirror the interactions of the real site (there's actually a section in the post about sophisticated attacks which addresses this).

Second, I doubt very much that old people would notice anything missing, particularly if you masked it as a site redesign/upgrade. I myself am a fairly cautious user, but would I notice if the site for the MasterCard I recently got, which I've logged into maybe 3-4 times and never more than once a month, asked for my username and password up front rather than in a 2-stage format? I honestly doubt I would.

I think old people and the less tech-savvy users are exactly the people who would notice something like this.

The less a person understands about computers, the more they rely on habit to use them. My mother calls me to ask what she should do whenever the tiniest change or unexpected balloon pop-up appears. The answer is invariable always the same: "Ignore it". But she calls every time, without fail, regardless.

So you might not notice the security image at all. My mother, who's used to her bank website always looking a certain way, will become very concerned when the security image is missing.

That's exactly how my mother behaves as well. She does online stock trading so she has good reason to be cautious.

I disagree with your second point. I manage a financial services portal that uses what looks like this same system (from RSA). We deployed it to satisfy regulatory requirements. Any time there is a hiccup in the system (such as RSA's servers going down or slow) we are flooded with calls asking if it is safe to login. Our users are not tech-savvy, and many are 40+.

This is true for a frequent user but honestly I log into so many different web sites that I'm pretty certain I'd not think much of anything if one of the login pages was redesigned without notice. Fortunately I'm also pretty sure I'd never fall for phishing links, but I'm sure the list of people who'd fall for both is sufficiently long that it doesn't matter.

Right. It's not correct that people will blithely accept an error like "Error: this image failed to load." These people don't think about errors the same way we do. To them all errors are the same and mean there's a catastrophic failure. Developers understand that some errors are minor, but a user faced with an error, where he expects a reassuring "security image," will probably become fearful and bail from that page.

Of course, he might still type in his password even if he decides not to go through and submit the form, in which case his data is still compromised.

Fine, so just omit the area for the image completely. Showing an error in place of the image is obviously a stupid choice over just asking for the password up front, and just omitting it (by pretending there shouldn't be one) will not trigger panic in non-savvy or forgetful users.

This makes me wonder how sophisticated phishing setups are. This seems like something that they would want to A/B test to determine which "converts" more "users".

I think you missed the entire point of the article. Re-read it please.