Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SiteKey tried to help online banking customers spot a fake login by showing a personal image and phrase before asking for a password. The weakness was that those visual cues were not cryptographically tied to the real bank website: a 2006 security analysis argued that a live phishing intermediary could relay the login and reproduce the customer’s cues. That was a warning about the design, not proof that every SiteKey deployment was compromised.
What SiteKey was
SiteKey was a visual mutual-authentication system associated with PassMark Security and online banking. In April 2006, RSA Security announced that it had acquired PassMark and described its technology as using a password and device forensics to authenticate a user to a website, while visual images helped the site authenticate itself to the user. RSA’s acquisition announcement is a contemporary corporate description of the technology.
In the familiar SiteKey sign-in flow, a customer identified themselves first, then saw an image and phrase they had selected before entering a password. An unfamiliar device could also trigger challenge questions. The design aimed to make a fake page look suspicious if it could not display the customer’s expected cue.
How SiteKey was meant to deter phishing
The image and phrase acted as a shared visual signal. A customer who saw the expected cue could take it as evidence they were on the bank’s login page; a missing or incorrect cue was a reason to stop rather than enter credentials. The system therefore depended on the customer noticing the signal and reacting to it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
That is different from cryptographically binding an authentication exchange to the bank’s actual web origin. A familiar image can reassure a person, but by itself it does not prove which server supplied the page or prevent an intermediary from passing information between the customer and the bank.
Why a 2006 analysis questioned its protection
On July 18, 2006, Jim Youll, then CTO of Challenge/Response LLC, published “Fraud Vulnerabilities in SiteKey Security at Bank of America.” He argued that an attacker could place a fraudulent site between a customer and the bank, relay the customer’s interaction in real time, obtain the correct SiteKey image and phrase, and display those same cues on the fake page. If that relay succeeded, the cues would no longer reliably distinguish the genuine bank page from the attacker’s page.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Youll’s report is an attributed security analysis of a possible attack, not an efficacy trial or evidence that every SiteKey user was attacked. It also discussed a persistent browser token. Separately, the National Vulnerability Database search result for CVE-2006-7200 describes SiteKey challenge-bypass tokens that could persist without an end-user cancellation interface, potentially making replay easier if a token were stolen. The available summary does not establish detailed remediation steps, so it should not be treated as a complete technical account of the issue.
Free tools Windows power users keep installed
One-click scans. No signup required.
Did SiteKey actually stop phishing?
The evidence here does not establish a measured success rate or show how often SiteKey prevented phishing in practice. Its visual cue could help a careful customer notice an obvious mismatch, but Youll’s analysis explained why a real-time relay could undermine that protection even when the displayed cue looked correct. The supported conclusion is narrower than either “SiteKey stopped phishing” or “SiteKey never worked”: it was an attempt to use a personal visual indicator, and the design had a documented, plausible weakness.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Is SiteKey still used by Bank of America?
Do not assume that a current Bank of America sign-in flow is SiteKey. A secondary history reports that Bank of America and Vanguard discontinued SiteKey in 2015, but a primary discontinuation notice is not available here to independently confirm the date. Bank of America’s current small-business guidance instead discusses checking the address bar, device identity verification, challenge questions on unrecognized devices, and optional one-time authorization codes. The fact that an old FAQ URL may remain online would not establish that the historical system is still in use.
How current passkeys and security keys differ
Passkeys and hardware security keys are modern authentication methods, not SiteKey components or continuations. The useful distinction is that they rely on cryptographic authentication rather than asking a user to judge whether a familiar image appears.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | What the user does | Phishing distinction | Compatibility and recovery |
|---|---|---|---|
| Historical SiteKey | Recognizes a selected image and phrase before password entry. | The visual cue was not itself cryptographically bound to the bank’s origin; Youll’s 2006 analysis argued it could be relayed. | Historical implementation; current availability is not established here. |
| Bank of America passkey | Uses a passkey, with a public key stored by the bank and a private key held on the user’s device or password manager. | Bank of America says the passkey is unique to the person, app, or website; this is a cryptographic approach rather than a visual check. | Use depends on the bank’s supported sign-in options and the user’s device or password manager. Recovery details are not stated on the cited FAQ. |
| FIDO hardware security key | Uses a registered physical key to authenticate to a compatible service. | Google describes Titan keys as providing cryptographic proof for the service where the key was registered, which helps resist phishing. | Works only with services and devices that support the relevant FIDO standards; users should check compatibility and arrange account recovery or backup options. |
Bank of America’s passkey FAQ describes its passkey model. For a hardware example, Google’s Titan Security Key information describes supported USB and NFC options and FIDO interoperability. Titan is not a SiteKey accessory or a required purchase; a key is useful only where the account and devices support it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsPractical checks when signing in to a bank
For present-day account protection, follow the bank’s current sign-in guidance rather than relying on an old SiteKey image or phrase. Bank of America’s small-business help page recommends checking the browser address for its official domain and explains its device verification and authorization-code options. Its exact instructions and available authentication choices may change.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
- Check the address bar for the bank’s genuine domain before entering credentials; do not rely on a familiar-looking page alone.
- Use the bank’s currently offered authentication methods, such as a passkey or one-time authorization code, where available.
- If considering a hardware security key, confirm that the bank account, browser, and device support it, and understand how you would regain access if the key is lost.
- Stop if an unexpected page, address, or authentication request does not match the bank’s stated process; navigate to the bank through a known bookmark or typed address rather than continuing through a suspicious link.
Current Bank of America guidance is available on its small-business online banking security page.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
