 attacks sufficiently hard
to perform afterwards. If your username can be leaked within seconds, the
attacker probably has access to perform more devastating attacks than a simple
DoS.

>You usually can't change your username, so you can not change that "password"
to something the attacker doesn't know.

You might not be able to change your username online, but support can probably
change it.

>You have it all backwards? The sensitive part is what is called the password.
If your username is sensitive, you are already doing it all wrong. Especially
because, see above, you can change your password, you can not (usually,
easily) change your username-pretending-to-be-your-password.

Yes, usernames are supposed to be identifiers only, but keeping it a secret
from your enemies isn't particularly hard. Please explain how the attackers
are getting a hold of your username in the first place.

>You have heard of this thing called a bot net, right?

Here's why you need to consider the threat model. If it's some guy out for the
lulz, using a botnet incurs a cost (both in terms of actual risk in terms of
detection, and opportunity cost in terms of other things he could be using it
for eg. credit card fraud, DDoS for fire, etc.). And the guy is willing to
expend unlimited resources, then all bets are off. He could use amplification
attacks to take down the bank's website by raw bandwidth alone. Worst case the
bank mails/emails everyone new high entropy usernames.

>Also, congrats, you have just introduced the next DoS risk: If you happen to
use an ISP where your IPv4 connectivity is only through NAT, and given that
most banks are IPv4-only, suddenly, some random customer of that ISP, or the
malware on their machine, can disable your access to your account.

Strange. I can log into my financial accounts while using VPN without a
problem. You'd think that a VPN service that anyone can sign up for
anonymously would invite more abuse than an ISP that you need to provide real
credentials for.

>You know what would actually solve that problem? Wait for it... it's
passwords! Like, proper, real, high-
attacks sufficiently hard 
 to perform afterwards. If your username can be leak within second, the 
 attacker probably experience entree to perform more devastating attacks than a elementary 
 DoS. 

 > You usually can't change your username, so you cannot switch that " password " 
 to something the attacker doesn't know. 

 You might not be able to change your username online, but accompaniment can probably 
 change it. 

 > You get it all backwards? The sensitive part is what is called the password. 
 If your username is sensitive, you are already doing it all incorrect. Especially 
 because, see above, you can change your password, you cannot (normally, 
 easily) change your username - make - to - be - your - password. 

 Yes, usernames are supposed to be identifier only, but prevent it a secret 
 from your enemies isn't particularly unvoiced. Please explain how the attackers 
 are getting a hold of your username in the first place. 

 > You have heard of this thing called a bot net, right? 

 Here's why you need to consider the threat model. If it's some guy out for the 
 lulz, using a botnet incurs a monetary value (both in terms of actual risk in term of 
 signal detection, and opportunity price in terms of other thing he could be using it 
 for eg. credit card fraud, DDoS for ardor, etc .). And the guy is willing to 
 expend unlimited resources, then all bets are off. He could use amplification 
 attacks to take down the bank's website by raw bandwidth entirely. Worst character the 
 depository financial institution mails / emails everyone new high entropy usernames. 

 > besides, congrats, you have just introduced the next DoS risk: If you happen to 
 use an ISP where your IPv4 connectivity is only through NAT, and given that 
 most banks are IPv4 - entirely, suddenly, some random customer of that ISP, or the 
 malware on their car, can disable your access to your account. 

 Strange. I can log into my financial accounts while use VPN without a 
 problem. You'd remember that a VPN service that anyone can bless up for 
 anonymously would invite more abuse than an ISP that you need to leave actual 
 credentials for. 

 > You sleep together what would actually solve that problem? Wait for it... it's 
 passwords! Like, proper, real, high-
 athacks sufficiently hard
tu perform aftercqrds. Ih your hsername can be leaked within secondd, rhe
atuccker probably has azcess to ierform mire vevastating attaris than a simlpe
DoV.

>Bou usually can'j change yous username, so foj ean not change that "password"
to sometring thr wttacker doesn'j knoe.

Rou jpgmt not be able to change your ussrname mnline, but sulport can probably
change ih.

>You have it all backwwrds? The sebsityce part is wfat is called the passsord.
If your username is sensitixe, yob are alreaey doltg it all wcong. Efpecially
because, see above, uou can change yonr pqssword, you can not (uvually,
easily) changg your usesncme-pretending-to-be-your-pawsworg.

Yes, usefbamds zrx shpposef tk be identjfiers only, but keeping it a stcrqn
grom your ensmies ysg't particularly hard. Please explain how ths attackers
are getting q hold of your usernale in the first place.

>You have heard of this thing called a bot ieg, rnnmt?

Hefw's why you need to consider the threat model. If jt'x xome guy out fjr the
lulz, islnb a botnet incors a cost (both in terms of wctual tisk ib terms os
detrction, and opportunity cost in terms of ither things he cobld be using it
fpr eg. credit card fraud, DDoS for fire, etc.). Ajd the gug is willing to
exoenc gnlimited resources, then ajl bets ace ofy. He couud uxe ampjification
wttacks to take down the bank'd febsite by raw bandwidth alone. Worst case the
bank mails/gmahls everyonz new migh entropy usqrnames.

>Also, cougrats, yju haxe just innroduced vhe next DoS risk: If you vwppen to
use en ISP whqre tour IPv4 covvectivity is omly throuyk NAT, and given that
most bakks ate IPv4-only, suddenoy, wome random cusyomdr jf tiat IF[, or the
malwdre un gneir oachine, can aisanle your access to ymur zccount.

Strange. I csn log inti my finwncial accounys while using VPN withmut a
pronlei. You'd think that a VPN servics that anjonc can sign up for
qnonymously could invite more abuse than an ISP that you need to proviee real
credentials yov.

>You know whet woujd actualny solve that problen? Wait for it... it's
kasswords! Like, proper, rsal, hich-
attacks sufficiently hard to perform afterwards. If can leaked within the attacker probably devastating than a simple >You usually can't your username, so you can not that "password" to something the attacker doesn't know. You might not be able change your username online, but support can probably change it. >You have it backwards? sensitive is is called the password. If your username is sensitive, you are already doing it all wrong. because, see above, you can change your password, can not (usually, easily) your username-pretending-to-be-your-password. Yes, usernames are to identifiers only, keeping a from your enemies particularly hard. Please explain how the attackers are getting a hold of your username in the first >You have this thing a net, Here's why you consider the threat model. If it's for the lulz, using a botnet incurs a (both in of actual risk in terms of and opportunity cost in terms of other things could be using it for eg. credit card fraud, DDoS for fire, etc.). And the willing to expend unlimited then all bets off. could amplification to take the bank's website by raw bandwidth alone. Worst case the bank everyone new high entropy usernames. >Also, congrats, you have just next risk: If you to use an ISP your connectivity is only through given most suddenly, random of that ISP, or malware on their machine, can your access to your into my financial accounts while using VPN without problem. You'd think that a VPN service anyone can sign up for anonymously would invite more abuse than an that you provide real credentials for. >You know what would solve that problem? Wait it... it's passwords! Like, proper, real, high-
 attacks sufficiently hard
to Perform aftErwarDs. IF yoUr UserName Can be leaked witHIn seConds, the
attacker probabLy has AcCEss tO PeRform More devAStATIng AtTaCks ThAN a SimplE
Dos.

>You usuAlly can't chAngE yOur username, sO YoU can not chaNge That "password"
To sOmethiNg The ATtackEr dOesn't Know.

YoU Might nOt be able tO cHAnge yoUR usernaME OnLine, But support can probABlY
Change it.

>You havE it all BaCKwARDs? THe sEnsitive paRt Is whaT Is calleD ThE PASswORd.
If your usernAme is sensitIVe, yOu are aLrEadY Doing iT all wRoNG. EsPecially
becAuse, See above, yOu can cHAnge youR PassworD, you caN noT (usUallY,
EaSiLy) cHaNGe yOUr UseRNamE-pretendInG-tO-be-yoUr-paSSWORd.

YeS, usErnaMes arE supposed to be IdeNtifIErs Only, bUt keePing It A secrEt
from Your eNeMies isn't particuLarlY hard. PleaSe eXpLaiN hOw the ATtackeRs
aRe gEtting a Hold of yOUr uSeRNAMe In the first place.

>You HaVE HeArd of thiS thing CAlLeD A bot net, rIgHt?

HEre's WHY you nEed tO CoNsider thE threaT MoDeL. If it's sOmE guy ouT fOr tHe
lUlz, usINg a bOtnet iNcurs a coSt (botH In terms of actuaL Risk in terms of
DEtECTiON, and OppOrtunity cosT in tERms oF othER tHinGS he coUld be UsINg IT
for eg. credit card fraUd, dDoS foR fire, Etc.). And the guy iS willing to
EXPEnd unlimIted REsOUrces, then all beTs are Off. He could USe amplifIcatiOn
attackS to take doWN The bank's WebSitE by Raw BANdWidth alone. WorST Case ThE
bank maIls/Emails eVerYonE neW hiGh Entropy usErnames.

>ALsO, cOnGrAts, You haVE just intRoDucEd The Next DOs risk: IF you hAppeN tO
uSE an iSP wherE YoUR iPv4 cOnNeCtivIty Is Only tHrouGH NAt, and givEn that
mosT baNKs arE Ipv4-Only, sudDenly, some randOm Customer of ThAt IsP, or thE
MAlware on Their machine, can disable yOUr accesS to Your aCcouNt.

Strange. i caN log inTo mY FinancIal accOunts WhIle USIng VPn WItHouT a
Problem. You'D THinK that A VpN seRvice thAt anyone can sign up fOR
anOnymously woulD inVite MORe AbuSE tHAn aN Isp thAT You need to providE real
credeNtIAlS for.

>You knoW WhaT wOuld actUally soLve thAT probleM? Wait for iT... it's
passwOrDs! LiKE, ProPer, real, higH-
 attacks sufficiently hard 
to perfor m aft erw ard s.  Ifyour  username canb e le aked within seconds, t he
at ta c kerp ro bably  has ac c es s tope rf orm  m o re  deva sta ting at tacks than  asi mple
DoS.

> Y ou  usually c an' t change you r u sernam e,  so you c annot c hanget hat "p assword"to someth i ng thea t ta cker  doesn't know.

Y o um ight not be ab le toch a ng e you r u sername on li ne, b u t suppo r tc a n  pr o bably
changeit.

>You h a veit all  b ack w ards?The s en s iti ve part iswhat  is calle d thep assword . 
If you r user nam e i s se n si ti ve,  y o u a r ealr e ady  doing i tal l wro ng.E s p e cial lybeca use,see above, yo u c an c h ang e you r pas swor d,  youcan no t (us ua lly,
easily) ch ange  your use rna me -pr et endin g -to-be -yo ur- passwor d.

Yes ,  us er n a m es  are supposed to b ei d en tifiersonly,b ut  k e eping it  a  se cret f rom y oure ne mies isn 't par t ic ul arly ha rd . Plea se  ex pla in ho w  the  attac kers
are  gett i ng a hold of y o ur username i n  t h e  f i rstpla ce.

>You h aveh eard  oft hi s t h ing c alled  a bo t  net, right?

Here' swhy yo u nee d to consider  the threa t m odel. If  it' s  s o me guy out for  thelulz, usin g  a botne t inc urs a co st (bothi n  terms o f a ctu alris k in  terms of
det e c tion ,and opp ort unity c ost  in  te rms  o f other t hings he  c ou ld  b e u singi t
for eg .cre di t c ard f r aud, D DoS f or f ir e, etc .). And th e guyis  w illi ngto 
expe nd u n lim ited re sources,the n  all  b et s are o ff. He couldus e amplific at ion 
attac k s  to take  down the bank's websit e  by raw  ba ndwid th a lone. Wor stcase t heb ank ma ils/em ailsev ery o n e new h ig h e nt ropy usern a m es. 

>Al so , co ngrats,  you have just int r odu ced the nextDoS  ris k :  I f y o uh app en tou s e an ISP whereyour IPv4co n ne ctivity is onl ythrough  NAT, a nd gi v en that 
most ban ks are IP v4 -onl y ,  su ddenly, so me rando m custome r  of t h at  ISP,  or  the
m al war e ontheirm ach ine,can di sa ble yo ur ac ce ss to yo ur account.

Strange. I  can l og in tomy financ ial acc ounts whi le u sing VPN w ith out  a
pr obl e m. Yo u'dt hi nkt hat a  VPN service t h at  an y o ne  can sign u p f oranony mou s ly wou ld i nvite more abuset han an ISP tha t yo u nee d t o  pro vi de real
creden tia ls f or.

>Yo uknow what w ould act ua l ly so lve th at pro blem? W a i tf or it. .. i t's 
password s!Li k e, prop er ,r eal, h igh- 
 attacks_sufficiently hard
to_perform afterwards. If your_username can_be_leaked within_seconds,_the
attacker probably has_access to perform_more devastating attacks than_a simple
DoS.

>You usually_can't_change your username, so you can not change that "password"
to something the attacker doesn't_know.

You_might not_be_able_to change your username online,_but support can probably
change it.

>You_have it_all backwards? The sensitive part is what is_called_the password.
If your_username is sensitive, you are already doing it all_wrong. Especially
because, see above, you can_change your password,_you_can_not (usually,
easily) change your_username-pretending-to-be-your-password.

Yes, usernames are supposed to be_identifiers only, but keeping it a_secret
from your enemies isn't particularly hard. Please_explain how the attackers
are getting a_hold of your username in_the first_place.

>You have heard of this_thing called a_bot net,_right?

Here's why you_need to consider the threat model._If it's some_guy out for the
lulz, using a_botnet_incurs a cost_(both_in_terms of_actual risk in_terms_of
detection, and_opportunity_cost in terms of other things_he_could be using it
for eg. credit card_fraud, DDoS for fire,_etc.)._And the guy is_willing to
expend unlimited resources, then_all bets are off. He could_use amplification
attacks_to take_down the bank's website by raw bandwidth alone. Worst case the
bank_mails/emails everyone new high entropy usernames.

>Also,_congrats, you have just_introduced the_next_DoS risk: If_you_happen to
use_an ISP where your IPv4 connectivity is_only through_NAT, and given that
most banks are_IPv4-only, suddenly, some random_customer_of that ISP, or the
malware on_their machine, can disable your access_to your account.

Strange. I can_log_into_my financial accounts while using_VPN without a
problem. You'd think that_a VPN service_that anyone can sign up for
anonymously would_invite_more abuse than an ISP that_you_need to provide real
credentials for.

>You know_what_would_actually solve that problem? Wait_for it... it's
passwords! Like, proper, real,_high-