Possible Duplicate:
Effectiveness of Security Images
Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on Phishing, claiming that "few users refrain from entering their password when images are absent" and "this feature [...] is susceptible to other attacks" (which?). But even if users were attentitve to it, I'm having trouble wraping my head around the concept.
How does one ensure the seal will only be shown when the user is actually at that particular site? Looking at the source code from Yahoo's login page I see a myriad of techniques being used, but I find it hard to comprehend what are their purposes, and how they work together to achive its goal:
- JavaScript is used to check whether or not the page is in an
iframe
(not showing the image if it is - or if JavaScript is disabled); - The inserted image has a long random-looking token in its
src
, which I presume is to keep it secret; - The image url expires pretty quickly, so it can't be stolen and used somewhere else.
What I could infer from the above:
- The login page request must have been started from the user's browser, or else the cookie that holds the seal wouldn't be sent;
- If the attacker puts the page in an
iframe
, he can't access its contents due to same-origin policy. - Likewise, the attacker can't request it via Ajax, for the same reason.
- If the attacker puts the page in an
- On request of the login page, the server prepares an unique URL to serve that image (using the contents of the cookie - the image is not permanently stored in the server), with an unguessable token that the attacker could not have access;
- The image will only be displayed if the page successfully determines it is not in an
iframe
; thus, if the user sees the image, he can be confident that the site is legit.
Is my reasoning correct? Are there any known attacks to this scheme? (maybe something involving MitM, etc)