SiteKey is not an effective defense against phishing. In principle, it could be helpful for a tiny population of expert users who are very conscientious about examining the image and know how web security works, but those users are rare. However, a mechanism like this really needs to help protect average users, not just computer security experts. And, for typical users, SiteKey is not an effective defense against phishing, for reasons explained below.
The good news is that, today, phishing appears to be relatively low on the scale of risks. Phishing attacks don't seem to be very successful today. Therefore, the deficiencies in SiteKey may be acceptable. That said, SiteKey is mostly security theater: it doesn't add much security, for the typical user.
I should elaborate on how I can make such strong statements. As it happens, this question has been studied in the research literature and there is experimental data on it -- and the data is fascinating. The data turns out to have some surprises for all of us!
Experimental methodology.
SiteKey's use of a custom "security images" (and security phrase) has been evaluated in a user study, conducted with ordinary users who were asked to perform online banking in the lab. Unbeknownst to them, some of them were 'attacked' in a controlled way, to see whether they would behave securely or not and whether the security images helped or not.
The researchers evaluated two attacks:
MITM attack: The researchers simulated a man-in-the-middle attack that strips off SSL. The only visible indication of the attack is that lack of a HTTPS indicator (no HTTPS in the address bar, no lock icon, etc.).
Security image attack: The researchers simulated a phishing attack. In this attack, it looks like the users are interacting with the real bank site, except that the SiteKey security image (and security phrase) is missing. In its place, the attack places the following text:
SiteKey Maintanance Notice:
Bank of America is currently upgrading our award winning SiteKey feature. Please contact customer service if your SiteKey does not reappear within the next 24 hours.
I find this a brilliant attack. Rather than trying to figure out what security image (or security phprase) to show to the user, don't show any security image at all, and just try to persuade the user that it's OK that there is no security image. Don't try to defeat the security system where it is strongest; just bypass the entire thing by undermining its foundation.
Anyway, the researchers then proceeded to observe how users behaved when they were attacked in these ways (without their knowledge).
Experimental results.
The results? The attacks were incredibly successful.
Not a single user avoided the MITM attack; every single one who was exposed to the MITM attack fell for it. (No one noticed that they were under attack.)
97% of those exposed to the security image attack fell for it. Only 3% (2 out of 60 participants) behaved securely and refused to log in when hit with this attack.
Conclusions.
Let me attempt to draw some lessons from this experiment.
First, SiteKey (and security images) is ineffective. SiteKey is readily defeated by very simple attack techniques.
Second, when assessing what security mechanisms will be effective, our intuitions are not reliable. Even expert security professionals can draw the wrong conclusions. For instance, I've seen some competent and knowledgeable security folks argue that security images add some security because they force the attacker to work harder and implement a MITM attack. From this experiment, we can see that this argument does not hold water. Indeed, a very simple attack (clone the website and replace the security image with a notice saying the security image feature is currently down for maintenance) is extremely successful in practice.
So, when the security of a system depends upon how users will behave, it is important to conduct rigorous experiments to evaluate how ordinary users will actually behave in real life. Our intuitions and "from-first-principles" analyses are not a substitute for data.
Third, ordinary users don't behave in the way security folks sometimes wish they would. Sometimes we talk about a protocol as "the user will do such-and-such, then the server will do thus-and-such, and if the user detects any deviation, the user will know he is under attack". But that's not how users think. Users don't have the suspicious mindset that security folks have, and security is not at the forefront of their mind. If something isn't quite right, a security expert might suspect she is under attack -- but that's usually not the first reaction of an ordinary user. Ordinary users are so used to the fact that web sites are flaky that their first reaction, upon seeing something odd or unusual, is often to shrug it off and assume that the Internet (or the web site) isn't quite working right at the moment. So, if your security mechanism relies upon users to become suspicious if certain cues are absent, it's probably on shaky grounds.
Fourth, it's not realistic to expect users to notice the absence of a security indicator, like a SSL lock icon. I'm sure we've all played "Simon Says" as a kid. The fun of the game is entirely that -- even when you know to look out for it -- it is easy to overlook the absence of the "Simon Says" cue. Now think about a SSL icon. Looking for the SSL icon is not the user's primary task, when performing online banking; instead, users typically just want to pay their bills and get the chore done so they can move on to something more useful. How much easier it is to fail to notice its absence, in those circumstances!
By the way, you might wonder how Bank of America (or other banks who use similar methods) have responded to these findings. After all, Bank of America emphasizes their SiteKey feature to users; so how have they reacted to the discovery that the security image feature is all but useless in practice? Answer: they haven't. They still use SiteKey. And if you ask them about their response, a typical response has been something of the form "well, our users really like and appreciate SiteKey". This tells you something: it tells you that SiteKey is largely a form of security theater. Apparently, SiteKey exists to make users feel good about the process, more than to actually protect against serious attacks.
References. For more details of the experiment I summarized above, read the following research paper:
