My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:
- User visits the homepage of the bank.
- User enters their username and clicks login.
- If the username exists they are presented with their unique image and phrase, chosen by the user when they sign up to the online banking application. If the image and phrase are as expected, the user enters their password.
- If correct, the user is authenticated and has full access to their account, including viewing statements, paying bills, increasing/decreasing credit limits, etc.
The problem I find here is that if one knows the username of a user, they can enter this into the first stage and immediately be presented with the image/phrase combination for that account. An attacker could then easily use this information in a phishing attack against that user.
My question is:
Isn't this a large security flaw?
Addition: In response to the first answer I should add that upon providing a username which does not exist, the application responds with a "Please check the username provided" message.