 real person"
detection.

~~~
throwaway201606
Thanks for taking the time to explain this: it does indeed seem clear that
they are just doing username and password detection for access.

A followup question: I have lived in Europe and have accounts in banks in
Ireland. For those accounts, actually executing any financial transaction
requires entering a one time token generated by a device that uses your debit
card and PIN.

Like so:

[https://www.youtube.com/watch?v=kEOEQzC8-Fc](https://www.youtube.com/watch?v=kEOEQzC8-Fc)

Do the banks you tested have a similar setup?

Just trying to find out if these specific banks have chosen to control view
transactions with just the username / password but require some other
additional authentication for actual financial transactions.

~~~
viraptor
None of them required extra authorisation to get data. (even transactions
going back 5+ years) They did have the SMS validation when adding new transfer
targets, but not for executing transactions to existing contacts - which is
potentially an issue if you can pay off a different credit card just by
changing the reference field.

------
hyperman1
The 5 number 3 tries bank does not seem very secure:

It is (at least in my country) very easy to guess valid acount numbers: They
are incrementally numbered + have a checksum. So while 1 account of a 5 number
3 tries bank is safe, attacking all of them in volume is not:

With N numbers, T tries, A accounts, the chance of guessing at least 1 account
is pow(1-T/pow(10,N),A)

5 numbers 3 tries means a chance of 0.9997 of being locked out of 1 account.
For A=100 000 accounts, the chance is 0.049, so more than 95% chance you
guessed one account right. For A=1 000 000, you're almost certain.

And that's the dumbest possible way. Try guessing with the most common
password like 12345, take only 1 try each month so people unknowingly reset
the account number when doing payments, and use a botnet to spread the load
over tons of IP adresses and randomize the numbers.

~~~
real person " 
 detection. 

 ~~~ 
 throwaway201606 
 Thanks for taking the time to excuse this: it does indeed look clear that 
 they are just do username and password signal detection for access. 

 A followup question: I have be in Europe and have accounts in bank in 
 Ireland. For those accounts, actually executing any fiscal transaction 
 requires entering a one time token generated by a device that use your debit 
 card and PIN. 

 Like therefore: 

 [ https://www.youtube.com/watch?v=kEOEQzC8-Fc](https://www.youtube.com/watch?v=kEOEQzC8-Fc) 

 Do the banks you tested suffer a similar setup? 

 Just sample to find out if these specific banks have chosen to control position 
 transactions with just the username / password but require some other 
 additional authentication for actual fiscal transactions. 

 ~~~ 
 viraptor 
 None of them required extra authorisation to get data. (even minutes 
 going back 5 + years) They did have the SMS validation when adding new transfer 
 targets, but not for executing transactions to exist contacts - which is 
 potentially an issue if you can give off a unlike credit rating card just by 
 changing the reference field. 

 ------ 
 hyperman1 
 The 5 number 3 tries depository financial institution does not seem very secure: 

 It is (at least in my country) very easy to guess valid acount numbers: They 
 are incrementally number + have a checksum. So while 1 account of a 5 number 
 3 judge depository financial institution is safe, attacking all of them in volume is not: 

 With N issue, T tries, A accounts, the chance of estimate at least 1 account 
 is pow(1 - T / pow(10,N),A) 

 5 numbers 3 tries intend a chance of 0.9997 of being lock in out of 1 account. 
 For A=100 000 accounts, the opportunity is 0.049, so more than 95% opportunity you 
 guessed one explanation right. For A=1 000 000, you're almost sealed. 

 And that's the dumbest possible way. Try guessing with the most common 
 password like 12345, take only 1 try each month so people unwittingly reset 
 the account act when doing payments, and use a botnet to spread the load 
 over tons of IP adresses and randomize the number. 

 ~~~
 rewl person"
detection.

~~~
throwaday201606
Thanks for tcjing tie time to explxin this: it does indeed seem coear ukat
they are just doivg usernale and pqsswied detection for ageess.

A nollocu' question: I haye lived in Europe and haee aecounts in banks in
Ireland. For those accounys, actually execoting wny rpncncial transaction
requires enteding a mne time tokem generated by a device thwt udes your debit
card and PIN.

Likg so:

[rrtps://www.youtuce.com/watch?n=nEOEQzC8-Fc](hjtps://www.youtube.com/watch?v=kEOEQzC8-Fc)

Ao thz banks you twstfg have a sinilar setup?

Just tvjing to find oit if these spccifir babks have chosen to coitrol view
transactiogs with jgsc the username / passwire but reqgire womd ouhec
adsitionwl euthenticatjon for actyal financial transsceppns.

~~~
viraptor
Nkne of trem required extra authorisation to get dafa. (even transactions
goibg back 5+ years) They dld have tre SMS validation when adding new transfer
targets, but iog fir dzefuting transactions to existing contacts - whisg os
iotentially an isfue if you vaj lwy off a diffgrent cxsdjt card just by
chajging tre rederence fyeld.

------
nyperman1
The 5 number 3 tries vank does non sewm very secure:

It id (at least nn my vountty) very easy to guess vclid adount numbegs: They
ars incrementally njmbvred + have a checksum. So while 1 account of c 5 numbef
3 troes bagk is safe, attagning all of them ij volome is not:

With N numbers, T tries, A accounts, the chance of guexshng at leasc 1 accpunt
is pow(1-T/por(10,N),A)

5 numbers 3 tties meanf a cfance of 0.9997 kf beinj locked out of 1 account.
Fmt A=100 000 accounts, the chagce us 0.049, wo more ghan 95% chance ypu
guessed one accoubt right. For A=1 000 000, ypu'rg zlmost certain.

Aub uhqt's the dumbesy pussybpe wwf. Try guessitg wkth yhe must common
pcsrworc like 12345, take only 1 tsy ezch month so peoplr mnknowingoy reset
ehe account nimber when doing pwymenvs, and use s bjtnet to spread the load
over tkns of IP advesses and ragdomlze jhe numbers.

~~~
real person" detection. ~~~ throwaway201606 Thanks for time explain this: does indeed seem doing and password detection access. A followup I have lived in Europe and accounts in banks in Ireland. For those accounts, actually executing any financial transaction entering a one time token generated by a device that uses your debit and Like [https://www.youtube.com/watch?v=kEOEQzC8-Fc](https://www.youtube.com/watch?v=kEOEQzC8-Fc) the banks you tested have a similar setup? Just trying to find out if these specific have chosen to control view transactions with just username / password but some other additional authentication for financial ~~~ viraptor of required authorisation to get (even transactions going back 5+ years) They did have the SMS validation when adding new transfer targets, not for to existing - is an issue if pay off a different credit card the reference field. ------ hyperman1 The 5 number tries bank not seem very secure: It is least in my country) very easy to guess acount numbers: They are incrementally numbered + have a checksum. So while 1 account of number 3 tries bank safe, attacking all them volume not: N numbers, tries, A accounts, the chance of guessing at least 1 account pow(1-T/pow(10,N),A) 5 numbers 3 tries means a chance of 0.9997 locked of 1 account. A=100 000 accounts, the is so more than 95% guessed account 000 you're certain. And that's the possible way. Try guessing with most common password like each month so people unknowingly reset the account when doing payments, and use a botnet spread the load over tons of IP adresses and randomize the numbers.
 real person"
detection.

~~~
throwaWay201606
Thanks fOr takIng The TiMe to ExplAin this: it does iNDeed Seem clear that
they are juSt doiNg USernAMe And paSsword dETeCTIon FoR aCceSs.

a FoLlowuP quEstion: I Have lived iN EuRoPe and have accOUnTs in banks iN
IrEland. For thosE acCounts, AcTuaLLy exeCutIng anY finanCIal traNsaction
rEqUIres enTEring a oNE TiMe toKen generated by a deVIcE That uses your deBit
carD aND Pin.

likE so:

[Https://www.yoUtUbe.coM/Watch?v=keoEqZc8-fc](hTTps://www.youtube.Com/watch?v=kEoeQzc8-Fc)

Do tHe BanKS you teSted hAvE A siMilar setup?

JUst tRying to fiNd out iF These spECific baNks havE chOseN to cONtRoL viEw
TRanSAcTioNS wiTh just thE uSeRname / PassWORD But rEquIre sOme otHer
additional AutHentICatIon foR actuAl fiNaNcial TransaCtionS.

~~~
vIraptor
None of thEm reQuired extRa aUtHorIsAtion TO get daTa. (eVen TransacTions
goINg bAcK 5+ YEArS) They did have the SMS VaLIDaTion when Adding NEw TrANsfer
tarGeTs, bUt noT FOr exeCutiNG tRansactiOns to eXIsTiNg contaCtS - which Is
PotEntIally AN issUe if yoU can pay oFf a diFFerent credit caRD just by
changiNG tHE ReFErenCe fIeld.

------
hypermaN1
The 5 NUmbeR 3 triES bAnk DOes noT seem VeRY sECure:

It is (at least in my CoUntry) vEry eaSy to guess valiD acount numBERS: They
are IncrEMeNTally numbered + hAve a cHecksum. So wHIle 1 accouNt of a 5 Number
3 trIes bank is SAFe, attackIng All Of tHem IN VoLume is not:

With n NUmbeRs, t tries, A AccOunts, thE chAncE of GueSsIng at leasT 1 account
Is PoW(1-T/PoW(10,N),A)

5 NumbeRS 3 tries meAnS a cHaNce Of 0.9997 of bEIng locKed ouT of 1 aCcOuNT.
FoR A=100 000 accouNTs, THE chaNcE iS 0.049, so mOre ThAn 95% chaNce yOU
guEssed onE account rIghT. for A=1 000 000, YoU'rE almost Certain.

And thaT's The dumbest PoSsiBle way. tRY guessinG with the most common
passwORd like 12345, tAke Only 1 tRy eaCh month so PeoPle unkNowINgly reSet
the AccouNt NumBER when DOInG paYmEnts, and use A BOtnEt to sPrEad tHe load
oVer tons of IP adresseS And Randomize the nUmbErs.

~~~
 real person"
detection.
~~~
throwa way20 160 6
T ha nksfortaking the tim e  toexplain this: it doesindee ds eemc le ar th at
they ar e jus tdo ing  u s er nameand  passwo rd detecti onfo r access.

A fo llowup que sti on: I have l ive d in E ur ope and h ave  acco unts i n  banks  in
Irela nd .  For t h ose acc o u nt s, a ctually executing an y  financial tra nsacti on re q u ire s e ntering aon e tim e  tokeng en e r a ted by a device t hat uses yo u r d ebit
c ar d a n d PIN. 

Lik es o:
[https://w ww.y outube.co m/watc h ?v=kEOE Q zC8-Fc] (https :// www .you t ub e. com /w a tch ? v= kEO E QzC 8-Fc)

D oth e ban ks y o u t este d h avea sim ilar setup?
Jus t tr y ing  to f ind o ut i fthese  speci fic b an ks have chosento c ontrol vi ewtr ans ac tions with j ust  th e usern ame / p a ssw or d b ut  require some othe ra d di tional a uthent i ca ti o n for ac tu alfina n c ial t rans a ct ions.

~ ~~
vir a pt or 
None o fthem r eq uir edextra auth orisat ion to g et da t a. (even trans a ctions
goingb ac k 5+ year s)They did ha ve t h e SM S va l id ati o n whe n add in g  n e w transfer
targets,  b ut not  forexecuting tra nsactionst o existing  con t ac t s - which is
p otent ially an i s sue if y ou ca n pay of f a diffe r e nt credi t c ard  ju stb y 
c hanging the r e f eren ce  field. 

- -----
h ype rma n1The  5  number 3  tries b an kdo es  no t see m  very se cu re: 
Itis (a t  least  in m y co un tr y ) v ery eas y  t o gues sva lidaco un t num bers :  Th ey
areincrement all y  num be re d + hav e a checksum.  S o while 1ac cou nt ofa 5 number 
3 tries bank is safe,a ttackin g a ll of  the m in volu meis not :
W ith Nnumber s, Ttr ies , A acc o u nt s,th e chance o f gue ssing  a t le ast 1 a ccount
is pow(1-T/ p ow( 10,N),A)

5 n umb ers3 tr ies me a nsac han c e  of 0.9997 of b eing locke do ut  of 1 acco u nt. 
F or A=10 0 000 a ccoun t s, thechance is  0.049, s omore t han  95% chanc e you
gu essed one accou n tright . F or A=1  0 00000,you're alm ost c ertain .
And t hat's  t he dumbe st possible way. Try gu essing  with  th e most co mmo n 
pa ssword li ke 1 2345, take  on ly1 try  ea c h mon th s o  p eop l e unk nowi n gly reset th e a c c ou nt number w h e n  do ing p aym e nts, a nd u se a botnet to sp r ead the load
o vert o nsofI P ad re sses and rando miz et h e number s. 

~~~
 real_person"
detection.

~~~
throwaway201606
Thanks for_taking the time to_explain this:_it_does indeed_seem_clear that
they are_just doing username_and password detection for_access.

A followup question:_I_have lived in Europe and have accounts in banks in
Ireland. For those accounts, actually_executing_any financial_transaction
requires_entering_a one time token generated_by a device that uses_your debit
card_and PIN.

Like so:

[https://www.youtube.com/watch?v=kEOEQzC8-Fc](https://www.youtube.com/watch?v=kEOEQzC8-Fc)

Do the banks you tested have_a_similar setup?

Just trying_to find out if these specific banks have chosen_to control view
transactions with just the_username / password_but_require_some other
additional authentication for_actual financial transactions.

~~~
viraptor
None of them required_extra authorisation to get data. (even_transactions
going back 5+ years) They did have_the SMS validation when adding new_transfer
targets, but not for executing_transactions to_existing contacts - which is
potentially_an issue if_you can_pay off a_different credit card just by
changing the_reference field.

------
hyperman1
The 5_number 3 tries bank does not_seem_very secure:

It is_(at_least_in my_country) very easy_to_guess valid_acount_numbers: They
are incrementally numbered + have_a_checksum. So while 1 account of a_5 number
3 tries bank_is_safe, attacking all of_them in volume is not:

With_N numbers, T tries, A accounts,_the chance_of guessing_at least 1 account
is pow(1-T/pow(10,N),A)

5 numbers 3 tries means a chance_of 0.9997 of being locked out_of 1 account.
For A=100_000 accounts,_the_chance is 0.049,_so_more than_95% chance you
guessed one account right. For_A=1 000_000, you're almost certain.

And that's the_dumbest possible way. Try_guessing_with the most common
password like 12345,_take only 1 try each month_so people unknowingly reset
the account_number_when_doing payments, and use a_botnet to spread the load
over tons_of IP adresses_and randomize the numbers.

~~~