Hacker News Reader

Great, you've now effectively reduced your password complexity to a measly 8 characters, while forcing the user to remember a 16-character long password.

If the user selects their 'secret image' from a known pool of images (as would probably be the case if this is at the OS-level), then the attacker just has to select one of those images (preferably a cute one) and then they know that at least some of the users they snag will have that as their security image.

SiteKey is completely susceptible to Man-in-the-middle (unless the user is a scrupulous cookie-manager and refuses to re-authenticate a computer more than once), so adds minimal value over regular SSL.

SiteKey is also trivially vulnerable to the attack known as "I bet you didn't remember that this page should show you a SiteKey."