Do you know your SiteKey?

Alice Toth, Tuesday, March 27, 2007 @ 1:44 pm

SiteKey is a system some sites (notably banking sites) use to prevent customers from logging into fraudulent sites dummied up to look like the actual sites. During registration (or updating an account if it was created pre-SiteKey), the user is asked to select an image they would like to associate with their account. Thereafter, the SiteKey image is displayed when the user logs into the site, reassuring them that they’re logging into the actual site. In theory, displaying the image instills trust and confidence in the user.

The reality, according to a joint study conducted by Harvard and M.I.T., is that users tended to enter their password regardless of whether or not the image is displayed. Only a few refused to enter their password citing security concerns. Not good.

Now, keep in mind that the test was done in a controlled environment with the users being asked to conduct routine online banking activities. They may have felt secure in their surroundings (an official test, Harvard, M.I.T., etc.), and it may not have bothered them to find no image being displayed (if they even noticed). Plus, typing the url directly into the browser vs. clicking a link from an email generates different levels of security which may have caused them to go directly to the input boxes for login.

But perhaps the images (or lack thereof) were ignored for other reasons. For those of us who only rarely login to SiteKey sites, it’s next to impossible to remember the image that we’ve selected. Face it, I can barely remember my passwords. So even if I see an image, I have no level of assurance that the site is legitimate since my recollection of whether or not the proper image is being displayed is spotty at best.

However, there is one exception -- a site that allowed me to upload my own image and associate it with my account. Because I could use an image that is meaningful to me, the SiteKey implementation thereby became a much more effective tool in alerting me to the site's legitimacy. Amazing how things improve once you involve the user.

Related posts:

1. Web app security checklist (Braindump)
2. The Web’s Most Useful Sites
3. Four blatant iPhone usability blunders (and one constant annoyance)
4. IBM’s CoScripter: Greasemonkey for non-geeks
5. Drupal.org redesign – An Experiment in Design by Community

Comments (0)

User Experience Design

Comments

• Leave a comment
• Comment feed for this post
• TrackBack URL

None so far.

Leave a comment