On: We Got Phished

[BoysenberryPi]

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

[makmanalp → BoysenberryPi]

Here's some more info on that: http://security.stackexchange.com/questions/19155/effectiven...

[mamurphy → makmanalp]

As a note, I think many banks have now removed security images. My bank used to have them, and now they don't.

[BoysenberryPi → makmanalp]

That's incredible. Not sure if I underestimated hackers ingenuity or underestimated how gullible people are..

[throwthisawayt → BoysenberryPi]

I don't think it's gullible for a user to proceed when they see a site missing an image, I think it's gullible that an engineer expects that the user would notice without any actual evidence. seems like a cardinal sin of engineering - don't assume your users will behave a certain way.

[emodendroket → BoysenberryPi]

I don't know if it's "gullible" so much as not understanding or caring about the feature.

[AdmiralAsshat → BoysenberryPi]

I've run into several websites that use the "security image", and to be honest most of them I don't actually remember what they are until I see them. I can't choose the image myself, so one of them is something banal like a toaster. If I see the toaster, okay, I'm good. But am I 100% certain that if I see a banana instead that I'll say "Something is amiss here!"? I really don't know.

On the other hand, if I could upload my own security image for each site, I guarantee I would remember it, because I'd probably use something I drew myself.

[Karawebnetwork → AdmiralAsshat]

My bank has security image + security user written sentence.

If I don't see a big goofy dog saying "Who's a good boy? [my dog's name] is a good boy!", I know I'm not on the right website.

[startling → Karawebnetwork]

So, what's stopping the wrong site from making those requests to your bank and proxying the image?

[Tortoise → startling]

The bank sets a cookie on your machine and only displays the image if you have the cookie. You won't get the image on a machine you've never used to log in before.

[sopooneo → BoysenberryPi]

Couldn't the hacker just pass on the username that I assume is being used to select the photo on the real site, and then put that image in place on their fake login site?

[justinpombrio → BoysenberryPi]

My bank (ING Direct) had that. And then they were bought by Capital One, who removed it.

[theandrewbailey → justinpombrio]

Did you refuse to sign in without it?

[justinpombrio → theandrewbailey]

That would have been bad for me but not for the bank. I called them, got a non-answer, and was too apathetic to push harder.

[yitchelle → justinpombrio]

ING-Diba in Germany is still doing this. Here, I am assuming that ING Direct is the same folks as ING-Diba.

[x0x0 → BoysenberryPi]

But phishers can praxy the 3rd party site to you. And this isn't hard to do. It might help w/ your relatives, but for anything even mildly targeted you can certainly rent a couple t2.nano to pull this off...

[ghurtado → BoysenberryPi]

Yup. Verizon Wireless does this as well.