Air France requires account password to be between 4 and 6 characters

Re:Air France requires account password to be between 4 and ... by jleahy on Tuesday June 13, 2017 @08:06PM (#14549767)

Well even 4 numbers of 10,000 combinations. Say they lock the account out after 100 wrong attempts (hopefully), then assuming you don't choose 1234 or 0000 then you're pretty safe from a brute force attack.

I'm guessing they require this so you can type it in over the phone, that's the only sensible reason I can think of.

[ Parent | on HN ]

Re:Air France requires account password to be between 4 and ... by patrec on Tuesday June 13, 2017 @08:43PM (#14549951)

This is not safe at all. If you do this with a hundred accounts, you're likely to hack at least one.

[ Parent | on HN ]

Re:Air France requires account password to be between 4 and ... by corpMaverick on Wednesday June 14, 2017 @10:06AM (#14552780)

It is safe for the individual accounts. Like a zebra in a zeal.

[ Parent | on HN ]

Re:Air France requires account password to be between 4 and ... by tetha on Wednesday June 14, 2017 @07:04PM (#14556730)

Lock what precisely?

If you lock the specific account from all login attempts, you have a DoS opportunity on your hands.

If you lock the specific account from specific IPs, botnets win.

And I doubt a company would have requirements like this, and cross-ip and cross-account attack validations in place.

[ Parent | on HN ]