Slashdot Mirror
Study Finds Bank of America SiteKey is Flawed
An anonymous reader writes "The NYT reports on a Harvard and MIT study, which finds that the SiteKey authentication system employed by Bank of America is ineffective at prevent phishing attacks. SiteKey requires users to preselect an image and to recognize this image before they login, but users don't comply. 'The idea is that if customers do not see their image, they could be at a fraudulent Web site, dummied up to look like their bank's, and should not enter their passwords.
The Harvard and M.I.T. researchers tested that hypothesis. In October, they brought 67 Bank of America customers in the Boston area into a controlled environment and asked them to conduct routine online banking activities, like looking up account balances. But the researchers had secretly withdrawn the images.
Of 60 participants who got that far into the study and whose results could be verified, 58 entered passwords anyway. Only two chose not to log on, citing security concerns.' The study, aptly entitled "The Emperor's New Security Indicators", is available online."
Seems to me like the system itself is not flawed, but the way the users choose to operate on it. This could be due to a lack of clear explanation by the BOA website.
If BofA periodically did not show the image and then warned the user they had made a mistake by entering their password, users would soon be trained to look for the image. Setting up a security system once and then not reinforcing it periodically so that users take it seriously is the probelm.
Enhanced security measures thwarted by stupid users. More at 11!
It seems like most security systems based on users not being idiots are doomed to fail. Phishing attacks work because people don't follow normal security procedures, making the authentication process longer/more involved for the user seems to be an inherently flawed idea because it trusts the user to know what is best for him/her.
The SiteKey isn't flawed, the people are.
1. go to an unusual place,
2. sign an agreement form,
3. follow instructions that say: "Log into your account"
4. you're aware that people are watching you and will analyze what you did
whatever results they get do not prove anything other than:
People placed in a unfamiliar, controlled environment with Harvard scientists ogling at them will not check the security image.
h
You can lead a horse to water but you can't make them pay attention to security concerns...
The BofA login is helpful to me, I fully expect to see my login token when I login to my account and would not login if I didn't see it. Some people won't pay attention and there isn't ANYTHING that BofA could do to prevent that (that isn't outrageously inconvinient for me.)
It's to protect Bank of America from liability. If someone's account integrity is compromised due to phishing, the bank's ass is covered - they implemented a two-way authentication, the user just chose to ignore it (after indicating they read and understood the terms and function of the SiteKey)
Rex is 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Now, go forth and design systems that work, instead of blaming your design failure on the user.
www.jmagar.com
-
when will these 'researches' be arrested for pointing out flaws in a security system.
This coming from a bank who's website frequently goes down and when clicking links within my accounts page will suddenly (and randomly) tell its users how they have "successfully logged out" without a link to the main page to re-login and continue. And lets not forget the determination to automagically remove bank statements after six months and yet at the same time keeps pestering its users to cancel their paper copies. I would have to say that Bank Of America is the perfect example of how not to run a banking website. Every time I call their tech support I am costing THEM money.
Do you changes clothes while making the "chee-chee-cha-cha-choh" transformation sound?
Discussion and links to papers here:
e y-cant-save-you.html
http://bbaadd.com/blog/2006/08/security-why-sitek
This overview of "Fraud Vulnerabilities in SiteKey Security at Bank of America" is written for a non-technical audience. Some details have been greatly simplified, and some new material is presented. Readers seeking more depth of coverage should consult the original paper, available at the above URL.
Although this report discusses SiteKey at Bank of America Corporation, the general risks discussed here apply to all SiteKey sites including ING Direct and Vanguard.com, and they apply even more generally to any security method that relies solely on server-side interventions to detect and stop online fraud.
The problem is that it wasn't introduced well.
If someone is already familiar with the concept, then it makes sense. However, for most people, the explanation was an annoyance and a confusion one time when they logged in, and the rest of the time it's just an extra click before they can enter their password.
I have two banks that use that scheme for authentication. On both of them, one day they just popped up a picture and said, "what is this picture?" So you make a guess as to what is shown in the picture, and hope you guessed right.
On subsequent logins, they fill in your guess for you, so it seems ridiculous that they are asking what that picture every time.
Since the explanation was lost on most users, it's not surprising that they don't care that it's different.
Infact...if you just make a site that popped up a random picture and asked them to name it, I'd expect everyone would fall for it.
This isn't about customers being lazy or stupid, (well not always.) It's about the SiteKey deployment being inadequate and there being insufficient explanation for something that customers have never heard of before.
--Welcome to the Realm of the Hawke--
..the system itself is not flawed, but the way the users choose to operate on it Enhanced security measures thwarted by stupid users. More at 11! The SiteKey isn't flawed, the people are. It's a common error to ascribe problems with usability to 'idiot users'. The real problem is software that's designed for the wrong target group (experts, where it should be everyman) or just badly designed, confusing or poorly explained interfaces. The fact is, this system *has* to be designed to cope with clueless users. If it's only safe for use by people with an IQ over 100, then half the population will be at risk!My bank started doing this. They way I was introduced to it is when I logged in they asked me to select a picture and then pick a label for it. There was no explanation whatsoever.
Now, like most Slashdot readers, I'm a tech guy, but I didn't know what they were trying to do. My GUESS was that they were going to have me enter in the caption each time I logged in as a sort of separate password. It wasn't until I read some news article about it much later that I understood what the point of it was. I can't imagine your average user would have any idea either.
But, lack of explanation aside, the 'solution' is technically useless as well. So when I go to log in you display a picture and I have to not enter my password if my picture doesn't show up. but *ANYONE* trying to log in gets to see that picture. So all you've done is add a little work for the phishing site - when they're pretending to be the bank, they just have to go to BoA's site and start your login process and Bank of America will kindly display the picture that the phishing site needs to show you to make you think the phishing site is legitimate. If anything, this makes the phishing site look *MORE* legitimate. "Well, this site looks fishy, but it's got my photo, so there must not be a problem."
Yahoo has a better system - they show you a captcha you've picked, and they explain what it is, AND they only show it to you if you're logging in from a computer you've registered to see the captcha. Doesn't help you when you're not at your home computer, but works for most people most of the time and is thus an improvement without any drawbacks.
paintball
The few that did participate where either excessively trusting or clueless, making them more likely to not worry about the missing image either.
In a word, they used a biased sample.
I wholeheartedly agree. I am also a BofA customer, and while I have enjoyed a great banking experience with them, the SiteKey thing managed to piss me off. A year ago when they rolled out this crap and I was forced to sign up for it, I ranted on my blog about it. Here's an excerpt:
Bank of America has unrolled this stupid SiteKey thing, which just doesn't benefit the consumer much. It seems to be a way for them to have more plausible deniability without actually taking on any responsibility.
The idea is that you choose a little picture for your account, and the website saves a cookie on your computer. If you try to log into your bank account, and your browser has a valid cookie, the website will show your SiteKey picture.
If you recognize your SiteKey, you'll know for sure that you are at the valid Bank of America site. Confirming your SiteKey is also how you'll know that it's safe to enter your Passcode and click the Sign In button.
If you don't have a cookie then you're prompted with personal challenge questions that you have to answer in order to see your SiteKey picture. At that point if the right SiteKey picture shows up, you "know it's safe" to enter your actual password.
If I connect from a new computer, I basically have to enter a challenge response (password) before I can enter my password. It's simply a way for the bank to prove that they're the legitimate site, and that I'm not being phished. It doesn't actually authenticate me to the bank in any stronger way, since if an attacker knew the challenge answers and my password, he can still log in as me from anywhere. Granted, now he has to know more information, but it doesn't put it outside the realm of possibility. There will still be idiots who get phished and happily input their challenge, ignore the bogus SiteKey, provide their real password, and then find out all their money has been harvested away.
What really bothers me about it is that they're making it look like they care about security, but this is just another way for them to force the vigilance onto the consumers while providing themselves more loopholes to escape liability. It's another hoop that the consumer has to jump through, but it doesn't increase the responsibility on the bank's side of things. We need our government to make the financial institutions liable when their systems are exploited, instead of allowing them to blame the consumers, many of whom just aren't geeks and simply don't know any better. When it's an economic problem for the banks, then it will matter to them.
The site key is not a bad idea for those users who actually use it, but yes most people aren't paying attention. But I think it really ignores the more obvious solution. This is to frequently remind users to NEVER CLICK A LINK THROUGH E-MAIL. Type the website into your browser every time and you will never have this problem. I would put this scam in the same category as phone fraud phishing; most people know that you're not supposed to give your SSN or Bank Numbers when somebody calls you. This should raise suspicion immediately. I think the same approach for the internet is the best that we can hope for. Educate, educate, educate.
It seems likely to me that most people thought "Hmm, this page is suspicious", but that the obedience to authority (OTA) principles Milgram demonstrated made them go ahead and log in anyway.
It's not clear to me how you could fix the experiment to avoid OTA behavior overriding and destroying your actual data.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
They conducted a study in which people were asked to access their own bank accounts on computers and networks controlled by the experimenters (where they could then hack the site presentation and record the subjects' actions).
Nobody with a CLUE about online security would participate in such a study.
As for the two groups who were not using accounts set up for the purpose: They would be unfamiliar with the account settings, have no personal stake in the results, and could be expected to try to bull through anything seen as a "bug" in order to perform the assigned task.
Unless explicitly informed that this was a test of the security features and that refusing to log in if suspicious was an option they would be expected to breeze past the login to get to the meat of the transaction - even if they wouldn't do so if this were their own account in their own normal life. Yet such an instruction would alert them at login time, biasing the test in another fashion. (Meanwhile, "behave securely" doesn't cut it for such a notice. Indeed, it would give them more to distract them during the experiment.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way