Quote:
Originally Posted by Why
that feature is totally worthless and here is why...
i create a scam site and i get your username... so then i login with it.
then i see your secret image, and possibly your questions... so then i make a new scam site that re-creates both new security steps..
you come to my scam site again, and give me your secret answers, etc.
then i can go and login to your real account and steal everything inside....
sorry but that security feature is used by bank of america and its completely and utterly worthless, just makes stealing from you a bit harder, but if your stupid enough to not look for https connections and proper domains, this wont save you.
anyone with a nice bank account in switzerland or the likes will know what proper online banking security is like.
|
Also lets not forget that the "security question" thing is completely flawed... the way it is, anyone can bruteforce the questions first, and then type in the password... the way it should be in my opinion is that security question and the password should be entered at the same time on the same page...
but I guess lets not bitch too much, these changes are better than nothing...