Though it may be the case that the site key mechanism has failed thus far to be effective for the average user, if viewed as more of an “opt-in” security measure I find it highly effective — because I do opt to use it to enhance the security of my sessions.

I try to be mindful of warnings about security certificates, but having the site key mechanism gives me nearly full confidence that the site isn’t being spoofed. Without it, there would exist the possibility that someone could spoof the BoA site without SSL and I wouldn’t notice it. I would hope not, but who knows.

In any event, it certainly would be nice if they threw up a bogus site key identifier every once in a while. But I suppose the risk is that it would cause more harm than good, as I suspect that a large percentage of people would refuse to internalize what something like the “sitekey” is or how it can be useful, no matter how many times the virtues are extolled.

While the idea of a site key is nice, it’s simply not effective, as outlined in this news article that cites a Harvard/MIT study from a little over a year ago. Basically, people don’t notice and/or care if their site key is missing. That seems a little problematic. Despite the age of this article, Bank of America still has done nothing about it…in my mind, BoA should have 1 in every, oh, 20 logins result in a page that doesn’t have their site key. If the user proceeds as usual by typing in their password, a “You Could Have Been Phished” warning pops up. If you look for the link “Why isn’t my site key shown?” it takes you to the regular login page with a happy message at the top to the effect of “Congratulations, you passed”.

Anyway, read the article. It’s interesting.

The Alaska USA credit union requires users to enter their password on a keypad that contains randomly placed numbers and letters. The keypad also has a background that is of the user’s choosing. This is another mechanism to ensure identity and protect customers.