News for hackers. Stuff that matters.

A comment on Banks, Arbitrary Password Restrictions and Why They Don't Matter. Parent comment

Re:Banks, Arbitrary Password Restrictions and Why They Don't... by raesene9 on Wednesday September 18, 2019 @12:38PM (#21007103)
On the attacker's extra tries. that's assuming a straight username/password combo with no additional data.

For UK banks at least, I can't think of a single one that's only username/password.

The better ones are 2FA, the less advanced ones will at least have something like username+password+"some kind of secondary secret" so straight online brute force is unlikely to be successful.

Also your attacker shouldn't know about the impending lockout, so unless they have some way of knowing when a user has logged in, they'll end up locking the account (well assuming username/password ofc)

[ Parent | on HN ]
Re:Banks, Arbitrary Password Restrictions and Why They Don't... by maccard on Wednesday September 18, 2019 @03:06PM (#21008809)
The more advanced ones that use 2fa are really only 1fa (at least the two I have accounts with). Both allow you to reset your 2fa using the username+password on an install of their mobile device.
[ Parent | on HN ]