The weakest link (humans) includes the security people

You can never eliminate the

You can never eliminate the human factor. No matter how much you try, people will always introduce new problems in to otherwise perfect systems.

Educating people is part of

Educating people is part of the solution to this. However, not all companies have such trainings for their employees.

People, more often than not, would remember things that they need to remember - if someone would point out what these things are. Now that is a tough thing because we'd have to constantly remind each other of these little details.

I think what it comes down

I think what it comes down to is that people either just dont think it could happen to them or depend on the bank, etc...to make it secure for them. I think lack of education when it comes to security for internet use is also a big part of the problem

I think what it comes down

I think what it comes down to is employee education. Many just don't realize what they're risking by sending unsecured email. Banks especially should be paying close attention about securing outbound email with anti-theft software that not only encrypts emails, but also provides protection once it has been recieved. One example of such software is Taceo, using which the sender can disable the copy/print/forward/screen capture functions to ensure confidentiality.
Outbound email security is also a concern for healthcare offices, financial institutions, lawyers, etc... who deal with sensitive client data on a daily basis. Unfortunately, most people won't pay attention until it is too late and vital information has already leaked out.

The concept behind the

The concept behind the picture isn't actually two factor authenitcation, but mutual authentication. Its intended to prove to the user that they are logging in to their bank's actual site, since the attacker would have no knowledge of the secret picture. Generally the second factor in these implementations is actually an encrypted cookie stored on the machine, counting as a token or "something you have".

I agree with the above

I agree with the above comments. I really fail to understand why banking sites show a picture for the second authentiation. Can some knowledgeable person please explain the concept? thanks in advance

My bank has just gone to a

My bank has just gone to a "two factor" authentication. However, it is relying on the password, and then showing you a picture (not a group of pictures to select from, just yours) to authenticate that they understand who you are. This is a rather pointless exercise. They are not authenticating that I am who I say I am with two factors. It does stop one form of phishing, but it does not do anything about man in the middle, or a stolen password.