Slashdot Mirror
Study Finds Bank of America SiteKey is Flawed
An anonymous reader writes "The NYT reports on a Harvard and MIT study, which finds that the SiteKey authentication system employed by Bank of America is ineffective at prevent phishing attacks. SiteKey requires users to preselect an image and to recognize this image before they login, but users don't comply. 'The idea is that if customers do not see their image, they could be at a fraudulent Web site, dummied up to look like their bank's, and should not enter their passwords.
The Harvard and M.I.T. researchers tested that hypothesis. In October, they brought 67 Bank of America customers in the Boston area into a controlled environment and asked them to conduct routine online banking activities, like looking up account balances. But the researchers had secretly withdrawn the images.
Of 60 participants who got that far into the study and whose results could be verified, 58 entered passwords anyway. Only two chose not to log on, citing security concerns.' The study, aptly entitled "The Emperor's New Security Indicators", is available online."
If BofA periodically did not show the image and then warned the user they had made a mistake by entering their password, users would soon be trained to look for the image. Setting up a security system once and then not reinforcing it periodically so that users take it seriously is the probelm.
Enhanced security measures thwarted by stupid users. More at 11!
It seems like most security systems based on users not being idiots are doomed to fail. Phishing attacks work because people don't follow normal security procedures, making the authentication process longer/more involved for the user seems to be an inherently flawed idea because it trusts the user to know what is best for him/her.
1. go to an unusual place,
2. sign an agreement form,
3. follow instructions that say: "Log into your account"
4. you're aware that people are watching you and will analyze what you did
whatever results they get do not prove anything other than:
People placed in a unfamiliar, controlled environment with Harvard scientists ogling at them will not check the security image.
h
You can lead a horse to water but you can't make them pay attention to security concerns...
The BofA login is helpful to me, I fully expect to see my login token when I login to my account and would not login if I didn't see it. Some people won't pay attention and there isn't ANYTHING that BofA could do to prevent that (that isn't outrageously inconvinient for me.)
It's to protect Bank of America from liability. If someone's account integrity is compromised due to phishing, the bank's ass is covered - they implemented a two-way authentication, the user just chose to ignore it (after indicating they read and understood the terms and function of the SiteKey)
Rex is 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Now, go forth and design systems that work, instead of blaming your design failure on the user.
www.jmagar.com
-
Nope, it's clear, but I fear users are oblivious. That's why Vista's annoying security notifications will not be as effective MS would like them to be.
"Yes, quit bothering me. How do I turn that off? Let me google it."
Well, there's spam egg sausage and spam, that's not got much spam in it.
People are, by definition, flawed. Any security system that is predicated on this changing sometime soon is broken.
Read my blog.
"If you don't read this..."
Actually, I'd suggest 'if you read this and believe this in any way makes you safe from phising you should take your banking offline'.
This scheme is worthless. Once the user enters his username the bank discloses the picture. There's nothing stopping a phishing site or trojan from immediately using the username to obtain the correct picture and displaying it to the user. IE, the explaining text should say 'if you recognize your SiteKey you still have no idea wether or not it's safe to enter your passcode'.
Whoever thought this up obviously missed a few computer security classes.
..the system itself is not flawed, but the way the users choose to operate on it Enhanced security measures thwarted by stupid users. More at 11! The SiteKey isn't flawed, the people are. It's a common error to ascribe problems with usability to 'idiot users'. The real problem is software that's designed for the wrong target group (experts, where it should be everyman) or just badly designed, confusing or poorly explained interfaces. The fact is, this system *has* to be designed to cope with clueless users. If it's only safe for use by people with an IQ over 100, then half the population will be at risk!It was not to hard to guess that that would be the very first response to this article. It is very typical for techies to expect users to use the system as the system was designed. That is not what happens in the real world. The usage of the system is equivalent to the system itself. If the usage of it is flawed, then the system, too, is flawed.
Many systems require you to change your password once a month or more often. Of course, the password must not be based on an English word and must contain both uppercase and lowercase letters and digits. Is it then a user failure when every other user forgets their password? No! It is the system that is faulty.
Therefore Bank of Americas system is faulty, most password based systems are infact faulty. It is not an acceptable excuse to put the burden on the user. It is a cop out. We are techies, we should make stuff work. It is our job.
Football Odds
The few that did participate where either excessively trusting or clueless, making them more likely to not worry about the missing image either.
In a word, they used a biased sample.
Rule #1 of user interface design: The user is always right. If he does something wrong, thank him for pointing out a flaw in your interface.
Assorted stuff I do sometimes: Lemuria.org
"Did you read the paper?" -- Yes.
/. I think) where people were required to inflict pain on another person whom they could hear in the other room, when that person did not achieve what was required. It was determined that because the person knew they were part of a study/experiment, they would inflict far more pain than they would normally - especially when told 'continue' by the program supervisor. Even after the 'actor' in the other room was in extreme pain, and exhibiting the audible characteristics of dying.
"The study attempted to control for this by telling one of the three groups that the purpose of the study was to test security awareness."
Exactly. That is my point, the people knew_they_were_part_of_a_study, and may have reacted differently to how they would normally.
I recall reading about a study (here on
I hope you realize that all those security questions don't make anything more secure either. In fact, I am of the opinion that they make things LESS secure, and they certainly make things less convenient for me.
Think about it. If I answer the questions truthfully, then a determined attacker would most likely be able to find out the answer to them through some means or another. If i answer the questions untruthfully then I now have to essentially remember 5 different passwords. Doable for one site, but the difficulty rises quickly if I have more than one site like this.
Never mind the fact that answers to the questions don't have to be of the same strength as a Password. (eg. I can answer with only 4 letters but a password would have to have 8 letters and 1 number or something)
I think its good that banks want to make their sites secure, but they way the have gone about it lately has started to get to me. It hasn't made anything more secure (I feel less secure) but it has made it much more difficult for me to get to my own information.