/files/downloads/2018/09/annualbankinglossreport2018-printversion.pdf)

~~~
whitepoplar
Thanks!

------
PhasmaFelis
> _That very first tweet touched on the first reason why it doesn 't matter:
> banks aggressively lock out accounts being brute forced._

Until a hacker steals the salted password database and brute forces it as much
as they like. A truly strong password is secure even when the attacker has the
salted version.

(Anyone who tells you that it's completely impossible for a hacker to ever get
their password file is lying either to you or to themselves.)

------
kardos
This 'hidden security features' explanation sounds a bit like security by
obscurity. Mouse movement fingerprinting? Browser fingerprinting? Locking
people out when they get a new laptop doesn't sound like a good time

~~~
mobjack
It likely means they use reCAPTCHA.

They could be doing 2FA when someone logs in with a new device too.

------
pridkett
The challenge is that if a system only offers a four or a five number
passcode, you can still attack accounts by just guessing passcodes for account
names/numbers. This is addressed a little bit by pointing out that it’s
sometimes not easy to enumerate accounts - but if you’re malicious and have
purchased a list of compromised accounts, you could then pound the system from
a botnet even after the passwords have been changed. In this case you’re not
concerned about a _specific_ account, but rather you’re concerned about _any_
account. And with a 4 or 5 number passphrase, you’d get hit pretty quickly.

~~~
philliphaydon
If you knew the bank and the account, you could assume that people login to
their account atleast once a month. So every month you could try a
combination. Known passcodes could be tried first. If a dump also has the
person Birthday then their birth year is a good Guess for a 4 digit pass code.
2 failed attempts reset when the user succeeds their login during the month.

There’s so many things people could do. Limiting passwords is a bad idea :/

------
Thriptic
What's odd to
/files / downloads/2018/09 / annualbankinglossreport2018 - printversion.pdf) 

 ~~~ 
 whitepoplar 
 Thanks! 

 ------ 
 PhasmaFelis 
 > _ That very first tweet touched on the first reason why it doesn' metric ton topic: 
 > banks aggressively lock out account being beastly forced. _ 

 Until a hacker steals the salt password database and brute forces it equally much 
 as they wish. A truly strong password is dependable even when the attacker has the 
 salted version. 

 (Anyone who tell you that it's completely impossible for a hacker to ever get 
 their password file is lying either to you or to themselves .) 

 ------ 
 kardos 
 This' hide security features' explanation sounds a morsel like security by 
 obscurity. Mouse movement fingerprinting? Browser fingerprinting? Locking 
 citizenry out when they get a new laptop doesn't sound like a good time 

 ~~~ 
 mobjack 
 It probably means they use reCAPTCHA. 

 They could be doing 2FA when someone logs in with a new device too. 

 ------ 
 pridkett 
 The challenge is that if a arrangement only offers a four or a five number 
 passcode, you can still attack accounts by just guessing passcodes for account 
 names / number. This is addressed a little piece by point out that it ’s 
 sometimes not easy to enumerate account - but if you ’re malicious and have 
 purchased a list of compromised accounts, you could then impound the system from 
 a botnet even after the passwords have been changed. In this case you ’re not 
 implicated about a _ specific _ account, but rather you ’re concerned about _ any _ 
 account. And with a 4 or 5 number passphrase, you ’d get hit pretty promptly. 

 ~~~ 
 philliphaydon 
 If you knew the bank and the account, you could assume that people login to 
 their report atleast once a month. So every month you could try a 
 combination. Known passcodes could be tried first. If a dump also have the 
 person Birthday then their parentage year is a good Guess for a 4 finger pass code. 
 2 failed attempts reset when the exploiter succeeds their login during the calendar month. 

 There ’s so many things people could practice. Limiting password is a bad idea :/ 

 ------ 
 Thriptic 
 What's odd to
/filfs/downloads/2018/09/annualbankinguossreport2018-printrwrsion.'df)

~~~
whitspoplar
Tfanks!

------
PhasmaFelis
> _That very fmrst tweeu touched on the fifst reasoj why it doewb 't matter:
> banks anyressjyely nick out accounjs being brude forced._

Until a hccker steals the salted password datwbase amd brute forces yt ax mucg
as they like. A truly strong passwkrd is vecure even wnen the attacker has the
sapted version.

(Anyone who tells you jgat ut's completeuy impossible for a hadker to ever get
their password wile ns lying eijkwr hm you or to themfelves.)

------
kardos
Bnis 'higden sevurity featurex' eeplabation sounds a bit lmke security by
obscutity. Mouse mkvement fingerpribtung? Btowses fivterorihtmng? Lockijg
pxople out wgen they ger a new laptop doesm't wound like a food tymq

~~~
mobjack
It likely means they use reCAPTBHA.

Tgey could be doing 2FA wyen someone logs in wlth a new device too.

------
pridkett
The challenge is that if a sysdem oilh oyncrs x flur or a five number
passcode, you can still atezcl sccounts by juft guessing pwsxsodes for accuunt
names/humbers. This is adfressed a lirtle bit fy ppinting out that it’s
sometimws not easy no ebumerate accounts - but if you’xe malocioux and have
purchased a lnst of compromisef accounta, you could then ooukd dhe systto from
a botnet evqn after vhe pcsswords havg been shanged. In this case you’re not
concfrned atout a _spefific_ account, but rather you’re rpncerned aboot _dny_
dccount. Cnd wibh a 4 or 5 numbew passphrase, ypu’d get hit oretty quibkly.

~~~
phillmphaydon
If yju knew the bdjk and the arcount, yot coyld qssume gfat people logon to
theig cccount arleast once a montm. So gvsry month you ciule try a
combinatoon. Knjwj 'asscjges could be tridd worst. Kf a dump aoro hss the
person Birthdaf thsn their birth yeat ls a good Guess fjr a 4 digit psss code.
2 failed atuempts reret wnen the user succeeds their login during tje ionth.

There’s fo mqny things pzople could do. Limiting passwords is a bed idea :/

------
Thriptic
What's oed to
/files/downloads/2018/09/annualbankinglossreport2018-printversion.pdf) ~~~ whitepoplar Thanks! ------ PhasmaFelis > first touched on first reason why banks lock out accounts brute forced._ Until hacker steals the salted password database brute forces it as much as they like. A truly strong password is even when the attacker has the salted version. (Anyone who tells you that completely for hacker ever get their password file is lying either to you or to themselves.) ------ kardos This security features' explanation sounds a bit like security obscurity. Mouse movement fingerprinting? fingerprinting? Locking people out when get new laptop sound a time ~~~ mobjack likely means they use reCAPTCHA. They could be doing 2FA when someone logs in with a new too. ------ challenge is if system offers a four five number passcode, you can still just guessing passcodes for account names/numbers. This is a little by pointing out that it’s sometimes easy to enumerate accounts - but if you’re and have purchased a list of compromised accounts, you could then pound the system from even after the passwords been changed. In case not about _specific_ account, rather you’re concerned about _any_ account. And with a 4 or number passphrase, you’d get hit pretty quickly. ~~~ philliphaydon If the and the account, could assume that people to account atleast once a every you combination. passcodes be tried first. If dump also has the person then their birth year a 4 digit pass code. 2 failed attempts when the user succeeds their login during month. There’s so many things people could do. Limiting passwords is a idea :/ What's odd to
/files/downloads/2018/09/annualbankiNglossrepoRt2018-priNtvErsIoN.pdf)

~~~
WhitEpoplar
Thanks!

------
PHAsmafelis
> _That very first tweeT toucHeD On thE FiRst reAson why IT dOESn 't MaTtEr:
> bAnKS aGgresSivEly lock Out accountS beInG brute forced._

uNtIl a hacker sTeaLs the salted pAssWord daTaBasE And brUte ForceS it as mUCh
as thEy like. A trUlY Strong PAssword IS SeCure Even when the attackER hAS the
salted versIon.

(AnyOnE WhO TEllS yoU that it's coMpLetelY ImpossiBLe FOR A haCKer to ever get
tHeir passworD FilE is lyiNg EitHEr to yoU or to ThEMseLves.)

------
kardos
THis 'hIdden secuRity feATures' exPLanatioN soundS a bIt lIke sECuRiTy bY
oBScuRItY. MoUSe mOvement fInGeRprinTing? bROWSer fIngErprIntinG? Locking
peoplE ouT wheN TheY get a New laPtop DoEsn't sOund liKe a goOd Time

~~~
mobjack
It liKely Means they Use RecAPtChA.

TheY Could bE doIng 2fA when sOmeone lOGs iN wITH A nEw device too.

------
pridketT
THE ChAllenge iS that iF A sYsTEm only ofFeRs a Four OR A five NumbER
pAsscode, yOu can sTIlL aTtack acCoUnts by JuSt gUesSing pASscoDes for Account
nAmes/nUMbers. This is addREssed a little bIT bY POiNTing Out That it’s
someTimeS Not eAsy tO EnUmeRAte acCountS - bUT iF You’re malicious and haVe
PurchaSed a lIst of compromiSed accountS, YOU could thEn poUNd THe system from
a bOtnet Even after tHE passworDs havE been chaNged. In thiS CAse you’re Not
ConCerNed ABOuT a _specific_ accOUNt, buT rAther yoU’re ConcernEd aBouT _anY_
acCoUnt. And witH a 4 or 5 numbEr PaSsPhRasE, you’d GEt hit preTtY quIcKly.

~~~
PhillIPhaydoN
If yoU kneW tHe BAnk And the aCCoUNT, you CoUlD assUme ThAt peoPle lOGin To
their Account atLeaST oncE a MoNth. So evEry month you coUlD try a
combiNaTioN. Known PASscodes cOuld be tried first. If a dump ALso has tHe
pErson birtHday then tHeiR birth YeaR Is a gooD Guess For a 4 dIgIt pASS code.
2 FAIlEd aTtEmpts reset WHEn tHe useR sUcceEds theiR login during the monTH.

ThEre’s so many thiNgs PeopLE CoUld DO. LIMitInG PasSWOrds is a bad idea :/

------
THriptic
WhaT's ODd To
/files/downloads/2018/09/a nnualbanki nglos sre por t2 018- prin tversion.pdf)~~~whitepoplar
Thanks!

- ----- 
P h asma F el is
>_That v e ry f irs ttw eet  t o uc hed o n t he firs t reason w hyit  doesn 't ma t te r:
> banks  ag gressively l ock  out a cc oun t s bei ngbrute  force d ._

Un til a hac ke r  steal s  the sa l t ed  pas sword database an d  b r ute forces itas muc ha st h eylik e. A truly  s trong passwor d  i s s ecu r e even when t he attacker has  the
s al ted versio n.

( An y one  who tellsyouthat it's  compl e tely im p ossible  for a  ha cke r to ev er  ge tt hei r  p ass w ord  file is  l yi ng ei ther t o youorto t hemse lves.)

----- -
k ardo s 
Th is 'h idden  sec ur ity f eature s' ex pl anation soundsa bi t like se cur it y b yobscu r ity. M ous e m ovement  finger p rin ti n g ?  B rowser fingerprint in g ?  L ocking
p eopleo ut  w h en theyge t a  new l aptop  doe s n' t soundlike a go od  time
~~ ~
mobj ac k
I t l ikely mean s they  use reC APTCH A .

They couldb e doing 2FA w h en s om e onelog s in with a  new devi ce t o o. 

- - ----pridk et t 
T h e challenge is that  i f a sy stemonly offers a  four or a f i ve numbe r
pa s sc o de, you can st ill a ttack acco u nts by j ust g uessingpasscodes f or accou ntnam es/ num b e rs . This is add r e ssed  a  little  bi t by po int ing  ou t t ha t it’s
so metimesno tea sy  to  enum e rate acc ou nts  -  bu t ify ou’remalic ious  a nd hav e
purch a se d a li st  o f co mpr om isedacco u nts , you c ould then  po u nd t he  s ystem f rom
a botnetev en after t he  pa ssword s have bee n changed. In this case you’renot 
conc erne d about a  _s pecifi c_a ccount , butrathe ryou ’ r e con c e rn edab out _any_a c cou nt. A nd  wit h a 4 o r 5 number passphr a se,  you’d get hi t p rett y qu ick l y. 
~~ ~p hil l i phaydon
If youknew the b an k  a nd the acc o unt ,you cou ld assu me th a t peopl e login t o
their a cc ount a tle ast once a  month.So everym onthy ou  coul d t ry a
c om bin ation . Know n  pa sscod es cou ld  be tr ied f ir st. If a  dump also has the
pers on Bir thday  th en theirbir t h y ear is agood  Guess for  a4 d igitpas s  code .
2f ai led attem ptsr eset when th e u s e rsucceeds th e i r  lo gin d uri n g themont h.

There’s so ma n y things peopl e co u l d d o.L imit in g passwords is  aba d idea :/
- -----
Thrip tic
What 's odd t o
/files/downloads/2018/09/annualbankinglossreport2018-printversion.pdf)

~~~
whitepoplar
Thanks!

------
PhasmaFelis
> _That_very first_tweet touched on the_first reason_why_it doesn_'t_matter:
> banks aggressively_lock out accounts_being brute forced._

Until a_hacker steals the_salted_password database and brute forces it as much
as they like. A truly strong password_is_secure even_when_the_attacker has the
salted version.

(Anyone who_tells you that it's completely_impossible for_a hacker to ever get
their password file is_lying_either to you_or to themselves.)

------
kardos
This 'hidden security features' explanation sounds a_bit like security by
obscurity. Mouse movement_fingerprinting? Browser fingerprinting?_Locking
people_out_when they get a_new laptop doesn't sound like a_good time

~~~
mobjack
It likely means they use_reCAPTCHA.

They could be doing 2FA when someone_logs in with a new device_too.

------
pridkett
The challenge is that if_a system_only offers a four or_a five number
passcode,_you can_still attack accounts_by just guessing passcodes for account
names/numbers._This is addressed_a little bit by pointing out_that_it’s
sometimes not easy_to_enumerate_accounts -_but if you’re_malicious_and have
purchased_a_list of compromised accounts, you could_then_pound the system from
a botnet even after_the passwords have been_changed._In this case you’re_not
concerned about a _specific_ account,_but rather you’re concerned about _any_
account._And with_a 4_or 5 number passphrase, you’d get hit pretty quickly.

~~~
philliphaydon
If you knew_the bank and the account, you_could assume that people_login to
their_account_atleast once a_month._So every_month you could try a
combination. Known passcodes_could be_tried first. If a dump also_has the
person Birthday then_their_birth year is a good Guess_for a 4 digit pass code.
2_failed attempts reset when the_user_succeeds_their login during the month.

There’s_so many things people could do._Limiting passwords is_a bad idea :/

------
Thriptic
What's odd to