The futility of site key images

[Mr.Slant]

Note that if you’re a large bank, and these tools result in even a 5% decrease in fraud losses that the bank is unable to recover, they are still worth millions to you.

[rbroome]

@CookingWithGas

I manage a group that implemented two-factor authentication for Department of Education employees this year. Site keys ain’t it. A site key isn’t user authentication at all. It’s *site *authentication. (We implemented TFA by using VeriSign tokens that generate sequences of numbers.)

BTW can a MITM site spoof the user’s computer to the genuine site? I am not a web developer and I don’t know what info a browser gets in the HTTP request that identifies a computer–I know that it can get an IP address, but that wouldn’t work well for dynamic IP assignment. MAC address?.

you are correct. site authentication is not two factor id. I mixed the ideas up. But my point that the site key idea was in response to a Gov’t (I believe Federal Reserve) regulation that also envisioned two factor authentication. Since site id is cheaper that is what got implemented even though it doesn’t help much with security.

[CookingWithGas]

@Alley_Dweller

I don’t know if I should post the exact mechanism in public, but it would be be trivially easy for a MITM to spoof the user’s computer. No, it doesn’t use IP or MAC addresses. It’s so trivially simple, I discovered it in just using the web site and doing normal things I do everyday on my computer and noticing that after I did a certain thing, it would ask me the security questions and if I did not do this certain thing, it would not ask me the questions until I did the thing again.

I wouldn’t want you to post a “how to hack” tutorial, although I note that what you did was entirely on your own computer. The bank’s web site does seem to detect if I am on a computer it does not recognize, and it re-authenticates me with challenge questions. So I have two theories about how this could work, but like I said I’m not a web developer so this might be naive:

1. HTTP includes data in the request header that uniquely identifies your computer. The bank keeps a record of that. In that case a MITM can simply read your header and spoof it when it forwards the request to the bank.

2. The bank’s site stores a unique identifier in a cookie, and checks the cookie when you log in. In that case a MITM could read the same cookie and simulate it on the attacking computer for when it forwards the login to the bank. However, I don’t know the underlying mechanism for how cookies work and if there is any security on them. That is, can any web site I connect to read any cookie they want?