News for hackers. Stuff that matters.

A comment on Banks, Arbitrary Password Restrictions and Why They Don't Matter. Parent comment

Re:Banks, Arbitrary Password Restrictions and Why They Don't... by kryogen1c on Wednesday September 18, 2019 @08:38AM (#21004691)
>> 5 lower case letters is ~12 million bits of entropy,

>That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000.

woops! youre totally right. added an edit.

>ad infinitum.

this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action.

>So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that?

You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.

[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by zAy0LfpBZLC8mAC on Wednesday September 18, 2019 @08:48AM (#21004777)
> this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action.

Except no lockout happens in this case?

> You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.

And what do you do when your bank tells you that they can't see any sign of fraud?

[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by RHSeeger on Wednesday September 18, 2019 @10:18AM (#21005678)
Or what do you do when you can't pay your rent/mortgage because the bank hasn't returned your money yet. All that convincing doesn't happen instantly.
[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by css on Wednesday September 18, 2019 @08:56AM (#21004858)
https://www.federalreserve.gov/supervisionreg/regecg.htm
[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by gruez on Wednesday September 18, 2019 @08:55AM (#21004852)
>Except no lockout happens in this case?

You're assuming that the lockout counter resets on successful login. Maybe there's a daily failed login counter.

[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by zAy0LfpBZLC8mAC on Wednesday September 18, 2019 @09:03AM (#21004931)
Well, maybe? But for one, that's a big maybe, but also, it does not fundamentally change the fact that an attacker has more than three tries, or whatever the official limit is.
[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by nybble41 on Wednesday September 18, 2019 @03:56PM (#21009371)
And being able to lock arbitrary people out of their accounts is also a form of attack.
[ Parent | on HN ]