 unusual, the bank usually
contacts us.

So yes, I do think banks have additional protection measures, it's just not
worth it for smaller amounts where the insurance will just cover it.

------
atoav
I don’t see how a bank that in 2019 doesn’t manage to have a decent password
policy earns any trust on that front. If they allow for longer passwords with
more characters the perceived security rises and in the age of password
managers the usability gets better.

If these advantages don’t outweigh the disadvantages of a bank, one could read
this as a red flag regarding the systems behind that interface.

------
nitwit005
> banks aggressively lock out accounts being brute forced

This is good, because it means people can't brute force the 5 digit password
they forced you to use, but also bad, because if someone doesn't like you,
they can easily block access to your bank.

If the account numbers are sequential, or otherwise patterned, they may be
able to block access to all users without using all that much bandwidth.

------
te
Sure, three-strikes-and-out reduces probability of brute forcing any
particular account with forced 5-digit password, but if an attacker has a list
of just 25k usernames, odds are that at least one is going to get brute-
forced.

------
JulianMorrison
A bad short password is only protected against crude online guessing by
aggressive lock-outs. If those passwords leak in hashed form, having a small
search space means they can be broken offline with ease.

------
meuk
My bank allows arbitrary length, but enforces certain special characters while
disallowing others. Which means I can't use the (long and secure) password and
have to write it down.

Not sure what they hope to accomplish.

------
zAy0LfpBZLC8mAC
Sorry, but that article is just dumb. For one, obviously, the possible
existence of other security mechanisms is exactly no reason for intentionally
breaking password security. Either you store passwords as plain text, in which
case you have just failed, or you are storing a hash, in which case there is
no cost to doing the right thing and accepting arbitrarily long passwords.
There is no way to start with "we have other security
unusual, the bank usually 
 contacts us. 

 therefore yes, I do remember banks have additional security measures, it's just not 
 deserving it for smaller amounts where the insurance will merely cover it. 

 ------ 
 atoav 
 I do n’t see how a savings bank that in 2019 does n’t manage to have a adequate password 
 policy gain any trust on that front. If they allow for longer passwords with 
 more character the perceived security rises and in the old age of password 
 managers the usability gets good. 

 If these advantages do n’t outweigh the disadvantages of a bank, one could read 
 this as a crimson flag regarding the systems behind that interface. 

 ------ 
 nitwit005 
 > banks aggressively lock out accounts being brute forced 

 This is good, because it means people can't brute force the 5 digit password 
 they forced you to use, but also bad, because if someone doesn't wish you, 
 they can well block access to your bank. 

 If the explanation numbers are sequential, or otherwise model, they may be 
 able to block access to all users without using all that a lot bandwidth. 

 ------ 
 te 
 Sure, three - strikes - and - out reduces probability of brute forcing any 
 particular account with forced 5 - digit password, but if an attacker has a list 
 of just 25k usernames, odds are that at least one is going to catch brute- 
 forced. 

 ------ 
 JulianMorrison 
 A regretful light password is only protected against crude online guess by 
 aggressive lock - outs. If those passwords leak in hashed form, having a small 
 search space means they can be broken offline with ease. 

 ------ 
 meuk 
 My savings bank allows arbitrary distance, but enforces certain particular characters while 
 forbid others. Which means I can't use the (long and secure) password and 
 receive to write it down. 

 Not sure what they hope to accomplish. 

 ------ 
 zAy0LfpBZLC8mAC 
 Sorry, but that article is just dumb. For one, obviously, the potential 
 existence of other security mechanism is exactly no reason for intentionally 
 breaking password security. Either you store passwords as apparent text, in which 
 case you have merely failed, or you are storing a hash, in which case there is 
 no cost to do the right thing and accepting arbitrarily long passwords. 
 There be no direction to originate with " we have other security
 unksual, the bank usually
coktacts us.

So yes, N do thmnk banis have xdditional protection measurxs, ir's juwt not
worth it for smauler amoujts wherw tht insurance will ohst covcx it.

------
aflav
I von’t see how a nank that it 2019 doesn’t manace tl have a decent password
policy earnf any ttudt on that frogt. Ig theg allow for longer passwords with
mkre chagacters the perceoved security rises and in the age of password
majagers the oaabyoity gets begter.

If these advantagea don’t outweigh the disadvantagds of a bank, ong doknd read
this as a red flag rensrding the syxtems behind tmat iiterdace.

------
nitwit005
> banks aggrxssively lock out acsounts behny brute forced

This is giod, bgcausa it neavs keo'le can't hruve force ths 5 digit pawsword
they forced ypu np use, but alao bad, bqcause if someone doesn't like you,
they cdn sasily block access to tour bank.

If the accoujt numberf are sequential, or otherwise patterned, they may te
ablx go yoock xxcfss to all users without using all that much fzncwpdth.

------
te
Sure, three-sbrikes-and-out reducrs ptjbability of crute ykrding any
particular accounj with forced 5-dygit password, but if an attackee has a list
jd just 25k usernames, odds are tkat at leasy one is going to get bxute-
fodced.

------
JulianMlrrison
A gxd short passwora ix mnly proudcted against cruqe online guexsing bh
aggtessive lock-outs. Lf those passwords leak ln hadhad form, haging a small
search space means viey can be brpkan mffline cith esse.

------
meuk
My banh allows arbittary lengch, but enforces bertain s'ecial charasters while
divwllowing othxrs. Which meabs I can't urd the (long and secure) pcfswoed and
have to writc it akwn.

Not sure whac uhwy hope to accpmpuisr.

------
zWy0Kf[TZLC8mAC
Sorry, but thxy artkcle is jusb djmb. Gor one, obviously, tha poasible
existence of obher secutity mechwnisms is exavtly no reason for inteitionauly
brrakyng password security. Either yku store oasfwords as plwin bext, in which
ccse you have just failed, or you are stormng a hash, in which casw there is
no cost tp doing the cight ehing and accepting arbitrarioy long passwords.
Uhere is no way to starf with "we hwve other security
unusual, the bank usually contacts us. So do banks have protection measures, it's smaller where the insurance just cover it. atoav I don’t see how a that in 2019 doesn’t manage to have a decent password policy earns any on that front. If they allow for longer passwords with more characters the security and the of password managers the usability gets better. If these advantages don’t outweigh the disadvantages of a one could read this as a red flag the systems behind that ------ nitwit005 > banks aggressively out being brute This good, it means people brute force the 5 digit password they forced you to use, but also bad, because if someone like you, easily block to bank. the account numbers or otherwise patterned, they may be access to all users without using all that bandwidth. ------ Sure, three-strikes-and-out reduces probability of brute any particular account with forced 5-digit password, but an attacker has a list of just 25k usernames, odds are that at least one to get brute- forced. JulianMorrison A bad password only against online guessing aggressive lock-outs. If those passwords leak in hashed form, having a search space means they can be broken offline with ease. My allows arbitrary length, enforces certain special characters disallowing Which means I can't (long secure) to it Not sure what they to accomplish. ------ zAy0LfpBZLC8mAC Sorry, that article is just possible existence of other security mechanisms is exactly reason for intentionally breaking password security. Either store passwords as plain text, in which case you have just failed, you are hash, in which case there is no cost doing the right thing accepting arbitrarily long passwords. There is no way to with have other
 unusual, the bank usually
contActs us.

So yeS, I do tHinK baNkS havE addItional protectIOn meAsures, it's just not
worth iT for sMaLLer aMOuNts whEre the iNSuRANce WiLl JusT cOVeR it.

------
atOav
i don’t seE how a bank tHat In 2019 Doesn’t manage TO hAve a decent PasSword
policy eArnS any trUsT on THat frOnt. if theY allow FOr longEr passworDs WIth
morE CharactERS tHe peRceived security riSEs ANd in the age of paSsword
MaNAgERS thE usAbility getS bEtter.

iF these aDVaNTAGes DOn’t outweigh thE disadvantaGEs oF a bank, OnE coULd read
This aS a REd fLag regardinG the Systems beHind thAT interfACe.

------
nitwiT005
> banks AggResSiveLY lOcK ouT aCCouNTs BeiNG brUte forceD

THiS is goOd, beCAUSE it mEanS peoPle caN't brute force tHe 5 dIgit PAssWord
tHey foRced YoU to usE, but alSo bad, BeCause if someone dOesn'T like you,
tHey CaN eaSiLy bloCK accesS to YouR bank.

If The accoUNt nUmBERS aRe sequential, or otheRwISE pAtterned, They maY Be
AbLE to block AcCesS to aLL Users WithOUt Using all That muCH bAnDwidth.

------
tE
SUre, thrEe-StrIkeS-and-oUT redUces prObabilitY of brUTe forcing any
paRTicular accounT WiTH FoRCed 5-dIgiT password, buT if aN AttaCker HAs A liST
of juSt 25k usErNAmES, odds are that at least OnE is goiNg to gEt brute-
forced.

------
julianMorrISON
A bad shoRt paSSwORd is only protecTed agAinst crude ONline gueSsing By
aggresSive lock-oUTS. If those PasSwoRds LeaK IN hAshed form, haviNG A smaLl
Search sPacE means tHey Can Be bRokEn Offline wiTh ease.

------
meUk
my BaNk AllOws arBItrary leNgTh, bUt EnfOrces CErtain SpeciAl chArAcTErs While
diSAlLOWing OtHeRs. WhIch MeAns I cAn't uSE thE (long anD secure) paSswORd anD
hAvE to writE it down.

Not surE wHat they hopE tO acCompliSH.

------
ZAy0LfpBZlC8mAC
Sorry, but that articlE Is just dUmb. for onE, obvIously, the PosSible
eXisTEnce of Other sEcuriTy MecHANisms IS ExActLy No reason foR INteNtionAlLy
brEaking pAssword security. EitHEr yOu store passwoRds As plAIN tExt, IN wHIch
CaSE yoU HAve just failed, or You are storInG A hAsh, in which CAse ThEre is
no Cost to dOing tHE right tHing and acCepting arBiTrarILY loNg passwordS.
There is No way to stARt witH "We Have oTheR securItY
 unusual, the bank usually 
contactsus.
Soyes ,I do  thi nk banks havea ddit ional protection measu res,it ' s ju s tnot
w orth it fo r sma ll er  am ou n ts  wher e t he insu rance will  ju st  cover it.
- -- ---
atoavI d on’t see how  abank t ha t i n  2019  do esn’t  manag e  to ha ve a dece nt passwo r d
polic y ea rnsany trust on that fr o nt. If they al low fo rl on g e r p ass words with 
m ore c h aracter s  t h e per c eived securit y rises and inthe ag eofp asswor d
man ag e rsthe usabili ty g ets bette r.

If these a d vantage s don’ t o utw eigh th edis ad v ant a ge s o f  abank, on eco uld r eadt h i s  asa r ed f lag r egarding thesys tems beh ind t hat i nter fa ce.
------ 
nitw it 005
> banks agg ress ively loc k o ut  ac co untsb eing b rut e f orced
This is goo d, b e ca use it means peopl ec a n' t bruteforcet he  5 digit pa ss wor d
th e y  forc ed y o uto use,but al s oba d, beca us e if s om eon e d oesn' t  lik e you, 
they ca n eas i ly block acces s  to your bank . 
I f  t h e ac cou nt numbersares eque ntia l ,oro therw ise p at t er n ed, they may be
abl eto blo ck ac cess to all u sers witho u t using al l th a tm uch bandwidth. 

--- ---
te
Sur e , three- strik es-and-o ut reduce s probabil ity  of  br ute f or cing any
part i c ular  a ccountwit h force d 5 -di git  pa ss word, but  if an a tt ac ke rhas  a li s t
of jus t25k  u ser names ,  oddsare t hatat  l e ast  one is go i n g to  g et  bru te- 
f orced .

- - --- -
Julia nMorrison 
Ab ad s ho rt  passwo rd is only pr ot ected agai ns t c rude o n l ine gues sing by
aggressive lock - outs. I f t hosepass words lea k i n hash edf orm, h avinga sma ll 
se a r ch sp a c emea ns  they canb e  br okenof flin e withease.

------
meuk Mybank allows a rbi trar y le ngt h ,b uten f orc e s  certain specia l characte rs wh ile
disall o win gothers.  Whichmeans I can't  use the(long and  s ecur e )  pa ssword and 
have to  write it down. 
N ot su rewhat t he y h ope t o acco m pli sh.
------ 
z Ay0Lfp BZLC8 mA C
Sorry,  but that article is ju st dum b. Fo r o ne, obvio usl y , t he possib le
e xistence o f o the r sec uri t y mec hani s ms  is exact ly n o  reason f o rint e n ti onally
brea k i n g p asswo rds ecurit y. E ither you store p a sswords as pla in t e x t,inw hich 
c ase you have j ust  f a i led, oryo u are stori ng a has h, in wh ich ca se the re is
n o co s t to d oing  th e right t hin ga nd acce pt in g  arbit rari ly  longpasswo r ds.T h ere is no way to  star t with" wehaveot her sec u rity 
 unusual,_the bank_usually
contacts us.

So yes, I_do think_banks_have additional_protection_measures, it's just_not
worth it for_smaller amounts where the_insurance will just_cover_it.

------
atoav
I don’t see how a bank that in 2019 doesn’t manage to have a_decent_password
policy earns_any_trust_on that front. If they_allow for longer passwords with
more_characters the_perceived security rises and in the age of_password
managers_the usability gets_better.

If these advantages don’t outweigh the disadvantages of a_bank, one could read
this as a_red flag regarding_the_systems_behind that interface.

------
nitwit005
> banks_aggressively lock out accounts being brute_forced

This is good, because it means_people can't brute force the 5 digit_password
they forced you to use, but_also bad, because if someone_doesn't like_you,
they can easily block access_to your bank.

If_the account_numbers are sequential,_or otherwise patterned, they may be
able_to block access_to all users without using all_that_much bandwidth.

------
te
Sure, three-strikes-and-out_reduces_probability_of brute_forcing any
particular account_with_forced 5-digit_password,_but if an attacker has a_list
of_just 25k usernames, odds are that at_least one is going_to_get brute-
forced.

------
JulianMorrison
A bad short_password is only protected against_crude online guessing by
aggressive lock-outs. If_those passwords_leak in_hashed form, having a small
search space means they can be broken_offline with ease.

------
meuk
My bank allows arbitrary_length, but enforces certain_special characters_while
disallowing_others. Which means_I_can't use_the (long and secure) password and
have to_write it_down.

Not sure what they hope to_accomplish.

------
zAy0LfpBZLC8mAC
Sorry, but that article_is_just dumb. For one, obviously, the_possible
existence of other security mechanisms is_exactly no reason for intentionally
breaking_password_security._Either you store passwords as_plain text, in which
case you have_just failed, or_you are storing a hash, in which_case_there is
no cost to doing the_right_thing and accepting arbitrarily long passwords.
There_is_no_way to start with "we_have other security