News for hackers. Stuff that matters.

A comment on Banks, Arbitrary Password Restrictions and Why They Don't Matter. Parent comment

Re:Banks, Arbitrary Password Restrictions and Why They Don't... by gruez on Wednesday September 18, 2019 @08:55AM (#21004852)
>Except no lockout happens in this case?

You're assuming that the lockout counter resets on successful login. Maybe there's a daily failed login counter.

[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by zAy0LfpBZLC8mAC on Wednesday September 18, 2019 @09:03AM (#21004931)
Well, maybe? But for one, that's a big maybe, but also, it does not fundamentally change the fact that an attacker has more than three tries, or whatever the official limit is.
[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by nybble41 on Wednesday September 18, 2019 @03:56PM (#21009371)
And being able to lock arbitrary people out of their accounts is also a form of attack.
[ Parent | on HN ]