Study Finds Bank of America SiteKey is Flawed 335
An anonymous reader writes "The NYT reports on a Harvard and MIT study, which finds that the SiteKey authentication system employed by Bank of America is ineffective at prevent phishing attacks. SiteKey requires users to preselect an image and to recognize this image before they login, but users don't comply. 'The idea is that if customers do not see their image, they could be at a fraudulent Web site, dummied up to look like their bank's, and should not enter their passwords.
The Harvard and M.I.T. researchers tested that hypothesis. In October, they brought 67 Bank of America customers in the Boston area into a controlled environment and asked them to conduct routine online banking activities, like looking up account balances. But the researchers had secretly withdrawn the images.
Of 60 participants who got that far into the study and whose results could be verified, 58 entered passwords anyway. Only two chose not to log on, citing security concerns.' The study, aptly entitled "The Emperor's New Security Indicators", is available online."
Flawed system or flawed usage? (Score:5, Interesting)
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
Re:Flawed system or flawed usage? (Score:5, Interesting)
I'm a B of A customer, and I thought it was made pretty clear about how the sitekey worked - so did my wife (as non-technical as she is). If people are not seeing their site-key and continuing with the 'experiment', perhaps the experiment was flawed. (The people may have felt they should continue even though the sitekey was not present, as they wanted the experiment to succeed.)
Also, I don't think I'd be logging into my BofA account on someones strange computer that was 'set-up' for me... fear of keyloggers and all that.
Re:Flawed system or flawed usage? (Score:5, Informative)
Did you read the paper? The study attempted to control for this by telling one of the three groups that the purpose of the study was to test security awareness. This group did just as badly as the others.
Re:Flawed system or flawed usage? (Score:4, Insightful)
"The study attempted to control for this by telling one of the three groups that the purpose of the study was to test security awareness."
Exactly. That is my point, the people knew_they_were_part_of_a_study, and may have reacted differently to how they would normally.
I recall reading about a study (here on
Re: (Score:3, Informative)
I agree (Score:3, Insightful)
It's not clear to me how you could fix the experiment to avoid OTA behavior overriding and destroying your actual data.
Re: (Score:3, Insightful)
Nobody with a CLUE about online security would participate in such a study.
As for the two groups who were not using accounts set up for the purpose: They would be unfamiliar with the account settings, have no personal stake in the results, and could be expected to try to bull through
Re: (Score:3, Interesting)
In my experience with the technology, websites do not adequately explain what it is you're doing and why.
The fault here doesn't lie just with the websites. As someone involved in implementing e-commerce websites, numerous user focus groups and usability analysis sessions indicate that people just wouldn't read the information even if you did bother to provide it, and moreoever they'd see it as off-putting and a detriment to using the site (I'm talking about the majority of users here, by the way, but it
Re: (Score:3, Insightful)
I couldn't agree more. People don't read. After our focus groups preceeding a recent launch, it was explained to me by a marketing fellow that we needed to explain a process and provide instructions for something that was
Re: (Score:2)
Re: (Score:3, Insightful)
Re:Flawed system or flawed usage? (Score:4, Insightful)
Actually, I'd suggest 'if you read this and believe this in any way makes you safe from phising you should take your banking offline'.
This scheme is worthless. Once the user enters his username the bank discloses the picture. There's nothing stopping a phishing site or trojan from immediately using the username to obtain the correct picture and displaying it to the user. IE, the explaining text should say 'if you recognize your SiteKey you still have no idea wether or not it's safe to enter your passcode'.
Whoever thought this up obviously missed a few computer security classes.
Re:Flawed system or flawed usage? (Score:5, Informative)
If I log in from a new computer (or clear cookies on my own), I have to add that computer to the safe list. That is, I have to get a new cookie.
In order to authorize a new computer, I have to answer one of three preselected security questions. These questions include:
What is your maternal grandmother's first name?
What is your maternal grandfather's first name?
In what city where you born?
What was the name of your first pet?
and 5 more that I don't care to take the time to count.
After this authorization takes place, my sitekey is displayed, allowing me to verify the authenticity of the site.
That's not to say it's foolproof, but it isn't quite as simple as you make it out to be.
What really makes it fun is when my mom's cookies get cleared, and she can't recall the answers to her questions.
Re: (Score:3, Informative)
This scheme is worthless. Once the user enters his username the bank discloses the picture. There's nothing stopping a phishing site or trojan from immediately using the username to obtain the correct picture and displaying it to the user. IE, the explaining text should say 'if you recognize your SiteKey you still have no idea wether or not it's safe to enter your passcode'.
Wrong. If you have not saved your userid (and thus have to enter it, as you would at a phishing site) then BofA will ask your security questions before allowing you to log in with the SiteKey. If you go to a phishing site, you would not only miss your security questions, but it would then have to get the sitekey picture.
So a phishing site, even with your userid, will have to try to retrieve your security questions and present them, long before it would ever get to the SiteKey.
If you can come up with someth
Re: (Score:3, Insightful)
Think about it. If I answer the questions truthfully, then a determined attacker would most likely be able to find out the answer to them through some means or another. If i answer the questions untruthfully then I now have to essentially remember 5 different passwords. Doable for one site, but th
Re: (Score:3, Interesting)
Unfortunately, that still doesnt help much; a trojan would have access to the cookie, and the phishing site could forward the security questions, faking lost or expired cookies (if it didnt just use cross-site scripting exploits to get it).
"If you can come up with something better, I'm all ears."
Well, it isnt easy to make the system foolproof, that's for sure. In a worst-case scenario (which is altogether far too
Re: (Score:2)
It needs to be a flash animation with 3d rendered anime dragons and magic small furry creatures, superimposed over videos of skateboarders bashing their nuts on rails.
The sad thing is it would probably improve security..
Re:Flawed system or flawed usage? (Score:5, Insightful)
Nope, it's clear, but I fear users are oblivious. That's why Vista's annoying security notifications will not be as effective MS would like them to be.
"Yes, quit bothering me. How do I turn that off? Let me google it."
Re: (Score:2)
You give users too much credit. The fact of the matter is that people are idiots. It's one thing for people not to recognize <a href="http://200.200.200.200/accountbalance">http: //www.bankofamerica.com/accountbalance</a> in their email. But for someone to go through the trouble of picking out a picture and then summarily dismiss
Re: (Score:2)
Re:Flawed system or flawed usage? (Score:5, Insightful)
Many systems require you to change your password once a month or more often. Of course, the password must not be based on an English word and must contain both uppercase and lowercase letters and digits. Is it then a user failure when every other user forgets their password? No! It is the system that is faulty.
Therefore Bank of Americas system is faulty, most password based systems are infact faulty. It is not an acceptable excuse to put the burden on the user. It is a cop out. We are techies, we should make stuff work. It is our job.
Re: (Score:3, Insightful)
Re: (Score:2)
There are certainly many security systems that fail to take into account human behavior - mostly draconian corporate ones. The BofA one is one of the friendliest I've seen; I know if I didn't see my SiteKey it would set off warning bells. What would be even better is if it allowed you to upload your own ima
Lack of explanation, and technically poor. (Score:3, Insightful)
Now, like most Slashdot readers, I'm a tech guy, but I didn't know what they were trying to do. My GUESS was that they were going to have me enter in the caption each time I logged in as a sort of separate password. It wasn't until I read some news article about it much later that I understood what the point of it was. I can'
Re: (Score:2)
The phisher now has to have a live connection and has one step closer to them tracked in the log file. Sure, it's probably a compromised machine, but now the phisher NEEDS a compromised machine. Not all of them go to that trouble yet.
This raises the bar a bit on the phishers. (Ruling out the inept 14 year old ones with free web site hosts in Lichtenstein.)
Every bit
Re:Flawed system or flawed usage? (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This could be solved... (Score:5, Insightful)
Re: (Score:2)
People want to access your site now and one in a while, you tell them "don't login now because we are doing an exercise, but if you login anyway, we will simply tell you it is bad before providing you the service", many people will simply chose to knowingly login because they trust their bookmark to link to the valid URL.
Re: (Score:2)
At this point, Computer exploitation has been in the news for almost a generation now, and people to this day still don't protect themselves against malware or inform themselves about scams. Hell, Windows screams at you if you don't have protection and still people run unprotected, Although it doesn't help much when MS scares people away from updating their OS with their Genuine Advantage program.
I'm a staunch believer of the 1% rule,
Newflash! (Score:5, Insightful)
It seems like most security systems based on users not being idiots are doomed to fail. Phishing attacks work because people don't follow normal security procedures, making the authentication process longer/more involved for the user seems to be an inherently flawed idea because it trusts the user to know what is best for him/her.
Re: (Score:2)
Re: (Score:2)
Re:Newflash! (Score:5, Insightful)
On a website all it needs is an official looking statement at the top of the phishing page that says "We are sorry, but our image security is broken just now, please log in as normal while we fix it, thank you." People are used to being told that computer systems are down and they should manage as best they can while they're repaired.
You simply can't regulate for people not willing to think for themselves.
Re:Newflash! (Score:5, Interesting)
Why is SSL accepted and widespread and PGP isn't? Because PGP requires people to deal with things they don't understand like fingerprints, keylengths and all that other technical stuff. SSL doesn't. If there's a yellow lock icon in the status bar, everything is good, otherwise something is wrong. That's the level that normal people deal with and it's not a fault of them.
You and I are the same, in areas we didn't study. What would you think if your doctor required you to understand every medical detail of that operation you need before he does it? You trust him to know his shit, that's what you pay him for, right?
It's time we earn our pay.
And I speak as a professional security guy. "User education" has failed because we tried to bring users to a high level of technical knowledge, instead of bringing the technical knowledge required down to their level.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You have formal and informal security. Formal security is long, complicated and tedious. I've yet to see it being used anywhere outside the military. Informal security works for normal people, but it is inherently flawed.
The problem isn't the user. The user is entirely himself. The problem is that we have no way to verify remotely that indeed he is he. All the additional bells and whistles are simply to cover up that simple fact. It's just another l
Sensationalist headline... (Score:3, Insightful)
Re:Sensationalist headline... (Score:5, Insightful)
People are, by definition, flawed. Any security system that is predicated on this changing sometime soon is broken.
Re: (Score:2)
Er, where can I lookup the definition of people?
(Yes, I know people are flawed -- but isn't by "definition".)
Re: (Score:2)
Not that I think anything will ever be able to claim 100% success in this. But arguing it's not a problem with SiteKey, but with people, is kind of like making a powertool for three hands then arguing it's a people problem that no-one can use it correctly. You knew before you started people's limitations.
Re: (Score:2)
The main failure of these "image recognition" systems is that they require the user to react to the absence of information. The lack of something, and especially something familiar, is very rarely even consciously registered, unless you are specifically trained to expect it and react to any change of presence.
Here's an experiment to try at home: Tell your spouse, kids, whoever, to choose one of the decorat
meh - controlled environment? (Score:5, Insightful)
2. sign an agreement form,
3. follow instructions that say: "Log into your account"
4. you're aware that people are watching you and will analyze what you did
whatever results they get do not prove anything other than:
People placed in a unfamiliar, controlled environment with Harvard scientists ogling at them will not check the security image.
h
Re: (Score:3, Insightful)
Biased sample? (Score:5, Insightful)
The few that did participate where either excessively trusting or clueless, making them more likely to not worry about the missing image either.
In a word, they used a biased sample.
Re: (Score:2)
:golf clap:
Damnit, where are my mod points when I need them?
Re: (Score:2)
It may not work in the long run, but it could definitely work.
Re: (Score:2)
Scientist: Hi, I'm a stranger, will you participate in an experiment where you enter your account information on my computer?
Person 1: What? Are you insane? No way!
Scientist: Hi, I'm a stranger, will you participate in an experiment where you enter your account information on my computer?
Person 2: Um
Scientist: Hi, I'm a stranger, will you participate in an experiment where you enter your account information on my computer?
Person
Re: (Score:2)
For as long as I can remember, the concept of spelling and grammar remains a central weak point of spammers. I sometimes wonder how much of the spam and phishing problem could be defeated by automated spelling/gram
It works for me... (Score:4, Insightful)
The BofA login is helpful to me, I fully expect to see my login token when I login to my account and would not login if I didn't see it. Some people won't pay attention and there isn't ANYTHING that BofA could do to prevent that (that isn't outrageously inconvinient for me.)
Re: (Score:2)
I agree. I also like the images being there when I log in. That being said, I have a dozen other accounts that do NOT have this - instead just have either the normal username/password pair or sometimes just username, with password being prompted for on another page, but no pictures (I have no Idea why).
Although I take security very seriously and almost never go to my banking sites when I'm not on my
SiteKey is not to protect customers (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
"It's to protect Bank of America from liability. If someone's account integrity is compromised due to packet sniffing, the bank's ass is covered - they implemented 128-bit SSL encryption, the user just chose to ignore the lack of the little key icon (after indicating they read and understood the terms and function of encryption)"
People are not "Flawed" (Score:5, Insightful)
Now, go forth and design systems that work, instead of blaming your design failure on the user.
Re: (Score:2)
So the challenge is to come up with a solution that requires the user to react properly and cannot be faked by a man-in-the-middle attack.
This solution obviously doesn't work. A captcha obviously doesn't work, as criminals can simply decode those
Re: (Score:2)
RSA login fobs have been around for many, many years, and I am not aware of a better system.
Policy is "Flawed" (Score:2)
I'm a more tech savvy user, but even I get very annoyed by the layers I have to go through:
pick a hole in my method please.... (Score:2)
in each box is 2-3 letters & 1-2 #'s that are randomly distributed on each page load.
I have to hunt for my password each time.
I click the individual box that represents the password characters 1 by 1, and something in that box gets added to the password box on screen.
look at a us keypad phone- if that PRECISE result popped up in the randomizer and my password is stick5tome
it would transmit 7842558663 to the website..
Re: (Score:2)
If you don't recognize your personalized SiteKey, don't enter your Passcode.
What they heck else is BofA supposed to do if their users cannot follow the most basic instruction. This has nothing to do with knowing the inner workings of your automobile or BofA's system. They don't have to. They need to be able to read and follow a simple instruction (which was explained fully when they set up their SiteKey to begin with).Re: (Score:2)
People are expected (and required) to pass a test given by the State to see if they can safely operate a vehicle. They're not required to change oil, swap out spark plugs, or install a sound system. They're supposed to already know how to get in, start the vechicle, put on safety belts, and operate the vehicle accordi
Re: (Score:2, Insightful)
My point is that I doubt very much that you understand the inner
BoA ppor implementation (Score:2)
Fishy? (Score:2)
I'm beginning to wonder if this article actually appears on the NYTimes website...
As a BOA customer... (Score:2, Informative)
Give me an online banking system with a
Re: (Score:2)
In that case give Washington Mutual a try. I'm been using their online banking for several years now. All it asks for is a user name and password. Although if you get your password wrong 3 times it locks your account and you have to physically go to the bank to unlock it. Rather annoying but at least I know my account won't be brute forced. Their site even plays nice in Seamonkey/Firefox on Linux.
Re: (Score:3, Interesting)
Bank of America has unrolled this stupid SiteKey thing, which just doesn't benefit the consumer much. It seems to be a way for them to have more plausible deniability without actually taking on any responsibility.
The idea is th
And don't get me started about those pictures. (Score:2)
I can't tell one image from another after a while.
I have accounts at several of those "pick-a-picture" type places and not a single one of them offers memorable porn images with which to motivate your security instincts!
Just once, I'd like to make phishers look at goatse man for a long time, before they even get a chance to rip some one off. Might make them think about prison too!
The Real Question is... (Score:4, Informative)
you have succeffully logged out! (Score:3, Informative)
Poorly designed populace (Score:2)
Security requires active checking to make sure a security measure is in effect. If you don't check to see if your padlock was secured, it's not the lock maker's fault if someone unhooked the unlocked padlocked and stole your stuff.
Actually this is worse. The lock maker damn well isn't at fault IF YOU DIDN'T CHECK THAT IT WAS YOUR PADLOCK.
The system is actually technically flawed (Score:5, Informative)
http://bbaadd.com/blog/2006/08/security-why-sitek
This overview of "Fraud Vulnerabilities in SiteKey Security at Bank of America" is written for a non-technical audience. Some details have been greatly simplified, and some new material is presented. Readers seeking more depth of coverage should consult the original paper, available at the above URL.
Although this report discusses SiteKey at Bank of America Corporation, the general risks discussed here apply to all SiteKey sites including ING Direct and Vanguard.com, and they apply even more generally to any security method that relies solely on server-side interventions to detect and stop online fraud.
Re: (Score:2)
One point bears repeating. The articles refer to Bank of America, but this applies to all sites that use similar mechanisms, such as Vanguard (mentioned above) and Yahoo!.
It's also worth noting that the large majority of users in the experiment ignored the absence of the SSL "p
Re:The system is actually technically (correction) (Score:2)
Sorry about that.
SiteKey Explanation insufficient. (Score:3, Interesting)
If someone is already familiar with the concept, then it makes sense. However, for most people, the explanation was an annoyance and a confusion one time when they logged in, and the rest of the time it's just an extra click before they can enter their password.
I have two banks that use that scheme for authentication. On both of them, one day they just popped up a picture and said, "what is this picture?" So you make a guess as to what is shown in the picture, and hope you guessed right.
On subsequent logins, they fill in your guess for you, so it seems ridiculous that they are asking what that picture every time.
Since the explanation was lost on most users, it's not surprising that they don't care that it's different.
Infact...if you just make a site that popped up a random picture and asked them to name it, I'd expect everyone would fall for it.
This isn't about customers being lazy or stupid, (well not always.) It's about the SiteKey deployment being inadequate and there being insufficient explanation for something that customers have never heard of before.
"It's the users, not the system!" syndrome (Score:5, Insightful)
Can lead a horse to water... (Score:2)
This reminds me of a training day for my workstudy job where one of the higher ups in the IT department talked about a survey done where they offered people a cookie for their password. At least 50% of the people i
Browser data (Score:2)
The site key is not in itself flawed... (Score:2, Interesting)
isn't this more network monitoring protection? (Score:2)
Hold on... (Score:2)
I mean where do you think they got these 67 BofA customers? They probably asked at a branch. They the folks know that this whole thing is at least done with the blessing of BofA.
Plus, I can't imagine the study administrators said things like, "and be sure to mind all the normal security practices" for fear that might bias the group.
Re: (Score:2)
If you received an e-mail you believed was from BofA and followed the link to their Web site, you'd similarly believe you were secure. That's one of the main goals of a phishing attempt, to lull you into that false sense of security. Hence the whole point of the study: to determine how well SiteKey does at cluing users in to the fact that there's a problem when they aren't expecting problems.
This is timely for me at work (Score:2)
I am currently doing contract work at a financial institution where we are evaluating several security measures from different vendors in order to comply with the FFEIC guidelines. One feature we are considering is a passmark.
At first the passmark seemed like a great idea until I tried to remember which of the borkerage accounts I had recently required me to set one up. At that poit I realized how virtually useless it really was, because if I couldn't remember if it was Fidelity or Vanguard (it was Vangu
Phishers Fool the Fools (Score:2)
News flash... (Score:2)
The screw is up anyway (Score:2)
It then gives you a page asking for your passcode without bothering with the site key junk.
So not only do the customers not pay any attention to it, the bank itself doesn't bother with it either.
I would have to agree with the study (Score:2)
My other experience was with my 70 year old father. He had no idea why he had blueberries, of how the picture got there even. He would not have cared what picture is there. He does not read the fine print, he just clicks and clicks to get in. I told him. You don't see blueberries, don't put in your password.
Overall I think it is a
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I hate to defend SiteKey, because it's a piece of shit, but BoA knows the user from the phishing site because any time a new IP address tries to access the image, the authentication does not include the SiteKey picture and instead asks the usual security questions.
Of course, BoA may have screwed the pooch on this one as well, so you never know.
Re: (Score:2)
Anyone who thinks social welfare is a complete waste of effort has obviously never had been given a pink slip, or still lives with mommy and daddy. When you got bills to pay and your employer decides to give you the boot it's nice to know that you're not facing the street at the end of the week.
Granted it gets abused, but that's why you enforce policy not cut people who need it off.
Though yea, generally if you don't take reasonable steps to ensure your safety, you're kinda
Re: (Score:2)
If I setup a "lemonade-stand" labeled "B of A Deposits" in my neighborhood and tell people they can make deposits with me instead of going to the bank, should the bank be held responsible if some people actually do it? At some point, people have to take responsibility.
It's not just that people aren't taking it seriously, it is that the system was designed without taking the human element into account. You say "what if I set up a lemonade stand" but that is exactly the same issue. That scam wouldn't work
Mod parent up! (Score:2)
Re: (Score:2)
Despite the fact that they were asking the participants to "role-play", they were told to use their own login credentials. Apparently, many of them were easily induced into handing out this information.