The login prompt for my student loan repayment site has two parts. You first enter your username, then it shows you an image as well as a password prompt. I picked the image when I first made my account from a few other potential images. However I don't see how this increases the security of the account at all. What's going on here?
I presume this to be form of mutual authentication. You're being displayed an image you had selected earlier. This way you can trust the incoming data from being original service provider. I am unsure for the effectiveness of the same especially in an MiTM attack.
It seems like a sort of captcha meant to prevent banking trojans from logging into your student loan account. These trojans are a sort of malware that are written to capture login credentials of users. In the event that you get infected and your credentials get stolen, the trojan would also have to enter the captcha.
However, in this case, if the "captcha" image is the same every time, then the banking trojan or malware will end up keylogging the captcha word as well ("http:") and there is no real effective protection against the bot logging in since it also knows what the captcha word is.
It seems like someone had the right idea but the implementation is flawed.
Another possibility, as someone pointed out, is that it is meant to protect against phishing pages masquerading as your bank. Even if they can make the page look like your student loan login page, that image is pulled from a database according to what you selected previously. There is no way for an attacker to know that if it's a generic phishing attempt targeted towards many users. You notice the lack of an image, or presence of incorrect image, and refrain from surrendering your credentials at a phishing page.
