> 3 trys - thats it.

Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum.

> 5 lower case letters is ~12 million bits of entropy,

That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000.

> again, as the article says, "Banks like ING will give you your money back". they have skin in the game and will refund your fraudulent charges.

So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that?

I agree with all your points except the last;

> If everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that?

two times I've reported fraud to two different banks. I was sent a letter from them stating "you say you didn't make X transaction, please sign and date and return", and I got the money back, no further questions asked. I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud. (Both my values we're under 300 pounds, for whatever it's worth, and I've found out since thatits a royal pain to spend > 1000 pounds on a debit card without being pre approved for the transaction)

> I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud.

OK, so my point still stands then?! I mean, it's certainly true that banks will generally refund (and in many jurisdictions have to refund) if they can tell that the customer was defrauded, and they also generally won't inconvenience their customers over small amounts.

But for one, you didn't say 100%, and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings. It's an easy business decision for a bank to immediately refund you 100 pounds if they expect to make more than 100 pounds from you by retaining you as a customer. It's very much not if you are asking them to refund you 100000 pounds. So, there is a bias in this mechanism that it primarily helps those who don't need it, but is of questionable reliability for those who really need it.

Plus, even if you do get your life savings back, you can be sure that just asking them to refund you 100000 pounds will not do the trick.

So, yeah, sure, banks will refund you more often than not. But my point was that that is not something you can really rely on when it actually matters, and I stand by that.

> and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings

I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance.

I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid.

> I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance.

Are they legally required to do so? Could an attacker circumvent this somehow (such as redirecting the calls to themselves)? ...

Apart from the fact that preventing me from using my money is terrible usability. If I am not contractually obligated to have my phone with me, but they suddenly refuse to authorize a transaction because they can't reach me on my phone, I suddenly have to fulfill some secret requirements in order to be able to spend my own money.

> I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid.

The point is: You recognize that that probably does happen. And that some of those cases could be prevented with strong passwords. So ... what is your point?

On the attacker's extra tries. that's assuming a straight username/password combo with no additional data.

For UK banks at least, I can't think of a single one that's only username/password.

The better ones are 2FA, the less advanced ones will at least have something like username+password+"some kind of secondary secret" so straight online brute force is unlikely to be successful.

Also your attacker shouldn't know about the impending lockout, so unless they have some way of knowing when a user has logged in, they'll end up locking the account (well assuming username/password ofc)

The more advanced ones that use 2fa are really only 1fa (at least the two I have accounts with). Both allow you to reset your 2fa using the username+password on an install of their mobile device.

>> 5 lower case letters is ~12 million bits of entropy,

>That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000.

woops! youre totally right. added an edit.

>ad infinitum.

this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action.

>So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that?

You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.

> this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action.

Except no lockout happens in this case?

> You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.

And what do you do when your bank tells you that they can't see any sign of fraud?

Or what do you do when you can't pay your rent/mortgage because the bank hasn't returned your money yet. All that convincing doesn't happen instantly.

>Except no lockout happens in this case?

You're assuming that the lockout counter resets on successful login. Maybe there's a daily failed login counter.

Well, maybe? But for one, that's a big maybe, but also, it does not fundamentally change the fact that an attacker has more than three tries, or whatever the official limit is.

And being able to lock arbitrary people out of their accounts is also a form of attack.

> Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum.

I don't understand how this is exploitable unless an attacker knows when a user logs in. Otherwise, how do they know when they have two tries again?

Well, how about the attacker knows when the user logs in, then? That's not exactly sensitive information ... or at least it shouldn't be. There sure are plenty of ways of how that info could leak out.

But also, an attacker might just not care? Just try to get into a vast number of accounts at a rate that generally, statistically, doesn't trigger lockout, and it might just be irrelevant that that triggers some lockouts here and there.