SiteKey is a web-based security system that provides one type ofmutual authentication betweenend-users and websites. Its primary purpose is to deterphishing.
SiteKey was deployed by several large financial institutions in 2006, includingBank of America andThe Vanguard Group. Both Bank of America and The Vanguard Group discontinued use in 2015.[1][2]
The product is owned byRSA Data Security which in 2006 acquired its original maker, Passmark Security.
SiteKey uses the followingchallenge–response technique:[3][4][5]
If the user is at a phishing site with a different Web site domain than the legitimate domain, the user's browser will refuse to send the state token in step (2); the phishing site owner will either need to skip displaying the correct security image, or prompt the user for the security question(s) obtained from the legitimate domain and pass on the answers. In theory, this could cause the user to become suspicious, since the user might be surprised to be re-prompted for security questions even if they have used the legitimate domain from their browser recently. However, in practice, there are evidence users generally fail to notice such anomalies.[5]
A Harvard study[6][7] found SiteKey 97% ineffective. In practice, real people don't notice, or don't care, when the SiteKey is missing, according to their results.
It also requires users to keep track of more authentication information. Someone associated withN different websites that use SiteKey must rememberN different 4-tuples of information:(site, username, phrase, password).
In May 2015, Bank of America announced that SiteKey would be discontinued for all users by the end of the year, and would allow users to log in with their username and password in one step.[1] In July 2015, Vanguard also discontinued the use of SiteKey for its website.[2]
{{cite journal}}:Cite journal requires|journal= (help)