 opposed to user-chosen
> usernames or email addresses so there goes the value in credential stuffing
> lists.

I've had accounts at most of the major US banks and I don't think I can think
of a single one that did this. Almost every single bank allows the user to
select a username or occasionally uses email for login. This is not a good
argument for Chase, Citi, Amex, Discover, Capital One, Barclays, and a whole
bunch more I can't think of off the top of my head.

------
lovehashbrowns
That whole blog post was sad, but this quote was particularly dumb:

> Banks like ING will give you your money back

Now, I don't have any experience with having my bank account hacked, but I
have had experience with my credit card getting used without my consent, and
it's NOT a fun process. I can't even imagine how that'd go with a bank and a
checking account. I can only guess that you have to 1. get the right customer
rep on the line and 2. wait a good while.

------
blackbrokkoli
People tend to get lost in mathematical technicalities in these discussion.
Yes, even really dumb limitations leave 100k+ possibilities open, much more
than you can brute force with a three-strike-lockdown. But that's not making
it ok. Even if some crafty hackers on the other side of the world find a way
to crack my account I'm confident the bank will look at the possible PR and
legal costs and just refund my money fully, yes, yes, wonderful. That is not
the problem.

The problem is _user inertia_. Let me speak as an averaged one, mixed with my
own deeds prior to being knowledgeable in cyber security.

If I'm forced to remember my password because my password manager gets shut
out or because of weird requirements, like uppercase letter + two numbers +
non-alphanumeric, I'm nudged to use the same variation of my "default
password" I used before, 27 times.

"DognameBirthyear&".

"+KeysThatAreCloseOnTheKeyboard1234+".

And of course, I use a slight variation of that for everything. Shady web-
server-under-the-desk web forum
opposed to user - chosen 
 > usernames or email address therefore there goes the value in credential stuffing 
 > lists. 

 I've have accounts at most of the major US banks and I don't intend I can intend 
 of a single one that act this. Almost every single savings bank allows the user to 
 choose a username or occasionally uses email for login. This is not a good 
 argument for Chase, Citi, Amex, Discover, Capital One, Barclays, and a whole 
 bunch more I can't think of off the peak of my head. 

 ------ 
 lovehashbrowns 
 That whole blog mail was sad, but this quote was particularly dumb: 

 > bank like ING will give you your money back 

 Now, I don't have any experience with having my bank report hacked, but I 
 have had experience with my credit card getting used without my consent, and 
 it's NOT a playfulness procedure. I can't even imagine how that'd go with a bank and a 
 checking account. I can only guess that you have to 1. get the right customer 
 rep on the channel and 2. wait a good while. 

 ------ 
 blackbrokkoli 
 multitude tend to get lose in mathematical technicalities in these discussion. 
 Yes, even really dense limitations leave 100k+ possibilities open, a lot more 
 than you can brute force with a three - strike - lockdown. But that's not making 
 it ok. Even if some crafty hackers on the other side of the world find a way 
 to crack my account I'm convinced the bank will expect at the potential public relations and 
 legal costs and just refund my money fully, yes, yes, fantastic. That is not 
 the problem. 

 The problem is _ user inertia _. Let me speak as an averaged one, mixed with my 
 own deeds prior to being intimate in cyber security. 

 If I'm pull to remember my password because my password manager gets close 
 out or because of weird requirement, like uppercase letter + two number + 
 non - alphanumeric, I'm nudged to use the same variation of my " default 
 password " I use before, 27 meter. 

 " DognameBirthyear & ". 

 " + KeysThatAreCloseOnTheKeyboard1234 + ". 

 And of course, I use a slight variation of that for everything. Shady web- 
 server - under - the - desk vane forum
 opoosed to user-chosen
> userkames or email aberessev so tgere goer the value in credential stnffibg
> liwts.

I've had accounts at most of nhe major US uanks and I don't think I can tglnk
of e single one thst did thiv. Almost every sknyle bank allows the user to
select a tsernamr lr occasionalli usex emajl for login. This is not a good
arghment fmr Chase, Citi, Amex, Discover, Capital One, Barflays, and a whole
bknch more I can'e think of ofw the top of my head.

------
lobehashbrowns
That whole blog posg was sad, but tyiw qkmte was parviculagly dumb:

> Banks like ITG will give you your moiey vack

Now, I don't have aiy experience with hwving my tauk account hacked, but I
yave vad axpefuenze sivh jy crefit card gettjng used wirhout my consent, anc
ie'w NOT a fun pdocess. I can't even imagine how that'd go with a tani and a
checking account. I can only guess thaj you have to 1. get the right customer
rep on the line and 2. wdit a eoob whild.

------
vlwckbrokkoli
People tend to get lost in mathemaejcsl technicalitief in these cidcifsion.
Yes, even reallv dhmb limitations lewve 100k+ pjssibulities oken, mich more
than you can brute dorce with a rhree-strike-lockdowu. But that's uot maling
iy ok. Even if some craftv hacksrs on the lther sids of the world fivd s fay
to crack my account I'm sonfident the bank wkll kook ae the posslble IS and
legal costs ajd judt refund my money fully, yes, yes, wonderful. Viat is not
the psobnem.

The pxoblem is _user inereia_. Let me speck as an averxged one, mpxed with my
own deedf prior to behjg knowledgeeble in crber secyrity.

If K'm forced to rrmember mj kassword bwcause my password mavzger gets shut
obu ot because of weord rezuprekegds, like uppescasd ldyter + two numberw +
non-slphanumeric, I'm nudgad tk use the same varoabion of mi "default
[assword" I usrd before, 27 times.

"DohnameUirthyxar&".

"+KeyxThwtAreCloseOnTheKeyboard1234+".

And of dourse, I kse a slight vawiatlon jf that fox everything. Shady web-
server-under-the-desk web forum
opposed to user-chosen > usernames or email there the value credential stuffing > most the major US and I don't I can think of a single that did this. Almost every single bank allows the user to select a or occasionally uses email for login. This is not a good argument for Citi, Discover, One, and a whole bunch more I can't think of off the top of my head. ------ That whole blog post was sad, but this was particularly dumb: > like ING will give you money Now, I have experience having my bank hacked, but I have had experience with my credit card getting used without my consent, and it's a fun can't even how go a bank and account. I can only guess that 1. get the right customer rep on the and 2. a good while. ------ blackbrokkoli People to get lost in mathematical technicalities in these Yes, even really dumb limitations leave 100k+ possibilities open, much more than you can brute a three-strike-lockdown. But that's making it ok. if crafty on other side the world find a way to crack my account I'm confident bank will look at the possible PR and legal costs refund money fully, yes, wonderful. That is not problem. problem is _user inertia_. speak an with own prior to being knowledgeable cyber security. If I'm forced remember my password because out or because of weird requirements, like uppercase + two numbers + non-alphanumeric, I'm nudged use the same variation of my "default password" I used before, 27 "DognameBirthyear&". "+KeysThatAreCloseOnTheKeyboard1234+". course, I use a slight variation of that everything. Shady web- server-under-the-desk forum
 opposed to user-chosen
> usernaMes or email AddreSseS so ThEre gOes tHe value in credeNTial Stuffing
> lists.

I've had accOunts At MOst oF ThE majoR US bankS AnD i Don'T tHiNk I CaN ThInk
of A siNgle one That did thiS. AlMoSt every singlE BaNk allows thE usEr to
select a uSerName or OcCasIOnallY usEs emaIl for lOGin. ThiS is not a goOd
ARgumenT For ChasE, cItI, AmeX, Discover, Capital ONE, BARclays, and a wholE
bunch MoRE I CAN't tHinK of off the tOp Of my hEAd.

------
lovehAShBROWns
tHat whole blog pOst was sad, buT ThiS quote WaS paRTiculaRly duMb:

> bAnkS like ING wilL givE you your mOney baCK

Now, I doN'T have anY experIenCe wIth hAViNg My bAnK AccOUnT haCKed, But I
have HaD eXperiEnce WITH My crEdiT carD gettIng used withouT my ConsENt, aNd
it's nOT a fUn prOcEss. I cAn't eveN imagInE how that'd go with A banK and a
checKinG aCcoUnT. I can ONly gueSs tHat You have To 1. get thE RigHt CUSToMer
rep on the line and 2. WaIT A gOod while.

------
BlackbROkKoLI
People tEnD to Get lOST in maThemATiCal technIcalitIEs In These diScUssion.
yeS, evEn rEally DUmb lImitatIons leavE 100k+ posSIbilities open, mUCh more
than you CAn BRUtE ForcE wiTh a three-strIke-lOCkdoWn. BuT ThAt's NOt makIng
it Ok. eVeN If some crafty hackers On The othEr sidE of the world fiNd a way
to crACK My accounT I'm cONfIDent the bank wilL look At the possiBLe PR and
lEgal cOsts and jUst refund MY Money fulLy, yEs, yEs, wOndERFuL. That is not
the PRObleM.

THe problEm iS _user inErtIa_. LEt mE spEaK as an averAged one, mIxEd WiTh My
oWn deeDS prior to BeIng KnOwlEdgeaBLe in cyBer seCuriTy.

if i'M foRced to rEMeMBEr my PaSsWord BecAuSe my pAsswORd mAnager gEts shut
ouT or BEcauSe Of Weird reQuirements, likE uPpercase leTtEr + tWo numbERS +
non-alphAnumeric, I'm nudged to use thE Same varIatIon of My "deFault
passWorD" I used BefORe, 27 timeS.

"DognaMeBirThYeaR&".

"+kEysThATarEClOsEOnTheKeybOARd1234+".

ANd of cOuRse, I Use a sliGht variation of that FOr eVerything. ShadY weB-
serVER-uNdeR-ThE-DesK wEB foRUM
 opposed to user-chosen
>usernamesor em ail  ad dr esse s so  there goes th e  val ue in credential stuff ing
>  l i sts. 
I 've h ad acco u nt s atmo st  of  t h emajor  US  banksand I don' t t hi nk I can thi n kof a singl e o ne that didthi s. Alm os t e v ery s ing le ba nk all o ws the  user tose l ect au sername o rocca sionally uses ema i lf or login. This  is no ta  g o o d
a rgu ment for C ha se, C i ti, Ame x ,D i s cov e r, Capital On e, Barclays ,  an d a wh ol e
b u nch mo re Ica n 'tthink of of f th e top ofmy hea d .

---- - -
loveh ashbro wns 
Th at w h ol eblo gp ost wa s s a d,but this  q uo te wa s pa r t i c ular lydumb :

>Banks like IN G w illg ive  youyourmone yback
Now,I don 't  have any exper ienc e with ha vin gmyba nk ac c ount h ack ed,  but Ihave ha d  ex pe r i e nc e with my credit c ar d ge tting us ed wit h ou tm y consen t,  an d
it ' s  NOTa fu n  p rocess.I can' t  e ve n imagi ne  how t ha t'd  go  with a ba nk and  a
check ing a c count. I can o n ly guess that yo u ha v e to  1.  get the ri ghtc usto merr ep  on the l ine a nd 2. wait a good while.
- -----black brokkoli
Peop le tend to g e t lost i n ma t he m atical technic aliti es in thes e  discuss ion.Yes, eve n reallyd u mb limit ati ons  le ave 1 00 k+ possibilit i e s op en , muchmor e
thanyou  ca n b rut eforce wit h a thre e- st ri ke -lo ckdow n . But th at 'sno t m aking it ok.  Even  ifso me cra fty hac k er s on t he  o ther  si de  of t he w o rld  find a  way
to c rac k  myac co unt I'm  confident th ebank willlo okat the p ossiblePR and
legal costs andj ust ref und  my m oney  fully, y es,  yes,won d erful.  Thatis no tthe p roble m . 
The  p roblem is_ u ser  iner ti a_.Let mespeak as an averag e d o ne, mixed wit h m y
ow n de eds pr i orto bei n g  knowledgeablein cyber s ec u ri ty.

If I' m  fo rc ed to r emember  my p a sswordbecause m y passwor dmana g e r g ets shut
o ut or be cause ofw eirdr eq uirem ent s, lik eupp ercas e lett e r +  twonumber s+
non- alpha nu meric, I 'm nudged to use the sa me var iatio n o f my "def aul t 
pa ssword" I  use d before,27tim es.
"Do g nameB irth y ea r&" . 

"+K eysT h atAreClos e On The K e yb oard1234+". A ndof co urs e , I us e aslight variationo f that for eve ryth i n g.Sha d y we b- 
server-under- the -d e s k web fo ru m
 opposed_to user-chosen
>_usernames or email addresses_so there_goes_the value_in_credential stuffing
> lists.

I've_had accounts at_most of the major_US banks and_I_don't think I can think
of a single one that did this. Almost every single_bank_allows the_user_to
select_a username or occasionally uses_email for login. This is_not a_good
argument for Chase, Citi, Amex, Discover, Capital One,_Barclays,_and a whole
bunch_more I can't think of off the top of_my head.

------
lovehashbrowns
That whole blog post was_sad, but this_quote_was_particularly dumb:

> Banks like_ING will give you your money_back

Now, I don't have any experience_with having my bank account hacked, but_I
have had experience with my credit_card getting used without my_consent, and
it's_NOT a fun process. I_can't even imagine_how that'd_go with a_bank and a
checking account. I can_only guess that_you have to 1. get the_right_customer
rep on the_line_and_2. wait_a good while.

------
blackbrokkoli
People_tend_to get_lost_in mathematical technicalities in these discussion.
Yes,_even_really dumb limitations leave 100k+ possibilities open,_much more
than you can_brute_force with a three-strike-lockdown._But that's not making
it ok._Even if some crafty hackers on_the other_side of_the world find a way
to crack my account I'm confident the_bank will look at the possible_PR and
legal costs and_just refund_my_money fully, yes,_yes,_wonderful. That_is not
the problem.

The problem is _user inertia_._Let me_speak as an averaged one, mixed_with my
own deeds prior_to_being knowledgeable in cyber security.

If I'm_forced to remember my password because_my password manager gets shut
out_or_because_of weird requirements, like uppercase_letter + two numbers +
non-alphanumeric, I'm_nudged to use_the same variation of my "default
password" I_used_before, 27 times.

"DognameBirthyear&".

"+KeysThatAreCloseOnTheKeyboard1234+".

And of course, I_use_a slight variation of that for_everything._Shady_web-
server-under-the-desk web forum