Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> And it looks like they were "useless" according to this article [0]. Someone even wrote a paper on it [1]. Seems several banks actually implemented this concept and then phased it out.

Okta still does that same trick on their login screens. Since I have several Okta logins, there's no way I would be able to remember which of the 9(?) icons matched with which domain, so I hear you about them being useless. I would be able to spot one of the "wrong" ones, as there are a class of those icons that I would never choose so ... security? :-/




Worse than useless, even if you do check the image they can be MITMed and in no way indicate that you are actually on the site you think you are on (they only help against the lowest effort static phishing sites). US banks decided that they would rather address the perception of insecurity rather than improving security. It isn't their money if someone gets scammed.

These days I think the best way to be sure you are on the correct site is to have the browser store at least the username/email used for a login and never login if the browser won't fill in that info (often saving the password is a good idea too depending on your situation). I've thought it would be helpful if browsers had a "site bookmark" feature that would show you are on a site you had previously labeled while visiting any page on the site, however I'm not aware of any browser actually doing that.

At the OS level a phrase could potentially work since there isn't the same MITM risk, although graphics drivers are complex and there could easily be a bunch of ways the phrase could leak. I wish there was a second small and simple display with at least a couple of buttons for security purposes. Maybe rough for phones but larger devices could do that. Or even two of them, one for communication with the OS and one for accessing credentials. The second could be removable for use with multiple devices. Of course, this comes with accessibility challenges that need to be considered.


The user should have to supply the image.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: