entropy passwords. Who would have thought?

You seem to be misunderstanding Troy's position. He's not saying it's ideal,
or even good practice. He's merely saying it's not as bad as you think. ie.
having a 6 digit numeric password doesn't mean you're going to get you hacked
within minutes.

>Except other countries have a slightly more modern banking infrastructure.
All of the EU is currently introducing realtime money transfers with a
guaranteed payment delay of maximum 10 seconds between any two banks in the
EU. Pulling transactions only every 15 minutes seems like quite a massive
delay in comparison.

I have a feeling that businesses that need low latency transactions aren't
doing so by scraping their bank's web page. They're probably using some sort
of payment provider, or the bank has an API.

>Well, yes, sure. But for one, that there is a persistent login fail counter
is a big if. If you are lucky, maybe there is. If there isn't, the bank will
blame you.

If anything, having a weak password gives you more plausible deniability than
having a 256 bit entropy password.

>They are obligated to do what? Give you back your money because you say so?
Certainly not. Be able to determine with 100% accuracy whether a transaction
was fraudulent? Yeah, sure?!

That's the point of obligating it by law. It's consumer protection to give
them the benefit of the doubt. If you have an airtight case against the bank
you wouldn't need it in the first place. I'd think you understand this
concept, given that you're from the EU. In any case, here's a citation for
you:
[http://www.nbcnews.com/id/8915217/ns/technology_and_science-...](http://www.nbcnews.com/id/8915217/ns/technology_and_science-
security/t/know-your-rights-bank-account-fraud/)

~~~
zAy0LfpBZLC8mAC
> So? If not randomly assigned, the best you can do is enumerate all users in
> an unpredictable manner. It's not like sequential usernames allows you to
> easily guess the username for a specific person.

... or just use their account number
entropy passwords. Who would have thought? 

 You seem to be misunderstanding Troy's placement. He's not say it's ideal, 
 or even good practice. He's merely saying it's not equally bad as you think. ie. 
 having a 6 finger numeral password doesn't mean you're going to get you hacked 
 within minutes. 

 > Except early countries have a slightly more modern banking infrastructure. 
 All of the EU is presently introducing realtime money transfers with a 
 undertake payment delay of maximum 10 second gear between any two banks in the 
 EU. Pulling transactions entirely every 15 minutes seems like quite a massive 
 delay in comparison. 

 I have a feeling that business that need low latency transactions aren't 
 doing therefore by scraping their bank's web page. They're probably using some sort 
 of payment provider, or the bank has an API. 

 > Well, yes, sure. But for one, that there is a persistent login fail counter 
 is a big if. If you are lucky, maybe there embody. If there isn't, the bank will 
 blame you. 

 If anything, have a fallible password gives you more plausible deniability than 
 having a 256 bit entropy password. 

 > They are obligated to do what? Give you back your money because you pronounce so? 
 Certainly not. Be able to determine with 100% accuracy whether a transaction 
 was fraudulent? Yeah, sure? ! 

 That's the decimal point of obligating it by law. It's consumer protection to give 
 them the benefit of the doubt. If you give birth an airtight font against the bank 
 you wouldn't need it in the first place. I'd think you sympathize this 
 concept, given that you're from the EU. In any case, here's a citation for 
 you: 
 [ http://www.nbcnews.com/id/8915217/ns/technology_and_science-...](http://www.nbcnews.com/id/8915217/ns/technology_and_science- 
 security / t / know - your - rights - bank - account - fraud/) 

 ~~~ 
 zAy0LfpBZLC8mAC 
 > So? If not randomly assign, the best you can act is enumerate all users in 
 > an irregular manner. It's not like sequential usernames allows you to 
 > easily guess the username for a specific person. 

... or merely use their explanation number
entgopy passwords. Who would have thought?

Yoo weem tm be mjsundersganding Troy's position. He's nlt sayibg it's ideal,
or even goud practibe. He's meeely waying it's not as ncd as nou tkiik. ie.
having a 6 cigit numesic password dmern'c mean you're going to get you hacked
rithin kijutes.

>Except otrer botntrjvs have a slightly more modern ganking infrastructute.
All of the EU is currentpy ijtroducing realtimf money trabsfeww with a
guarxnteed payment delay or maximum 10 seconds between any gwo bcnks in the
GB. Pupning transartions only every 15 minutes seems kike quite a msssmve
dwlay in comparison.

I heve a feeling that bosinesses dhct need low latency teabsacthons arev'r
dokng sp gy scrwpiig their bahk's web pagw. They're probably uxigt some sort
of paymegt provider, or the bank has an API.

>Well, yev, shre. But for one, that thwre is a persistent llgin fail counter
is a big if. If you are lucky, maybe there hs. If ghexc kwn'h, the bank will
blame you.

If anything, having a rsal iassword gives yom more plausible drnlanylity than
havkng a 256 bif entropy password.

>Hhey arg oblitated to qo wnat? Give you back your monet because yol sat so?
Certainly not. Ye able to dztermime wiyh 100% accuracy whether a cransadtion
was frwudulent? Gdah, sure?!

That's thd ppitt of obligating it by law. It's consnmer 'rotectiun tp give
ehem the bfnefib of the doubt. If ylu hare an airtight fase against the bank
you wouldn'v need it in jhe figst place. I'd tmink you underseand this
concekt, given chat yuu're from nhe EU. In any case, hqre's a citatimj for
you:
[http://xww.nbcnewf.com/ud/8915217/ns/rechnoluey_and_science-...](htyp://www.nbcnvwf.com/ud/8915217/ns/technology_and_sgiencg-
sscurity/t/know-youx-xithts-bank-account-grajd/)

~~~
zWy0Pf'BZLC8iDC
> So? If not ranaomuu asskgned, the bcst you can do is enumerate all users in
> an unprecigtable mabner. It's not like seqiential usernames wllowv yuu to
> eafily guess the username for a apecific oerfon.

... or just tse bheit account nbmber
entropy passwords. Who would have thought? You be Troy's position. not saying it's He's saying it's not bad as you ie. having a 6 digit numeric doesn't mean you're going to get you hacked within minutes. >Except other countries a slightly more modern banking infrastructure. All of the EU is currently introducing money with guaranteed delay of maximum 10 seconds between any two banks in the EU. Pulling transactions only every minutes seems like quite a massive delay in I have a feeling businesses that need low latency aren't so by their web They're probably using sort of payment provider, or the bank has an API. >Well, yes, sure. But for one, that is a fail counter a if. you are lucky, is. If there isn't, the bank If anything, having a weak password gives you plausible deniability having a 256 bit entropy password. are obligated to do what? Give you back money because you say so? Certainly not. Be able to determine with 100% accuracy whether was fraudulent? Yeah, sure?! the point of it law. consumer to give the benefit of the doubt. If you have an airtight case the bank you wouldn't need it in the first place. you this concept, given you're from the EU. any here's a citation for security/t/know-your-rights-bank-account-fraud/) zAy0LfpBZLC8mAC not assigned, best you can do enumerate all users in > unpredictable manner. It's not to > easily guess the username for a person. ... or just use their account
entropy passwords. Who would hAve thought?

you seEm tO be MiSundErstAnding Troy's posITion. he's not saying it's ideal,
or Even gOoD PracTIcE. He's mErely saYInG IT's nOt As Bad As YOu Think. Ie.
hAving a 6 dIgit numeriC paSsWord doesn't meAN yOu're going tO geT you hacked
wiThiN minutEs.

>excEPt othEr cOuntrIes havE A slighTly more moDeRN bankiNG infrasTRUcTure.
all of the EU is curreNTlY Introducing reaLtime mOnEY tRANsfErs With a
guaraNtEed paYMent delAY oF MAXimUM 10 seconds betweEn any two banKS in The
EU. PUlLinG TransaCtionS oNLy eVery 15 minutes SeemS like quitE a massIVe
delay IN comparIson.

I hAve A feElinG ThAt BusInESseS ThAt nEEd lOw latencY tRaNsactIons AREN'T
doiNg sO by sCrapiNg their bank's wEb pAge. THEy'rE probAbly uSing SoMe sorT
of payMent pRoVider, or the bank hAs an aPI.

>Well, yeS, suRe. but FoR one, tHAt therE is A peRsistenT login fAIl cOuNTER
iS a big if. If you are lucKy, MAYbE there is. if therE IsN't, THe bank wiLl
BlaMe yoU.

iF anytHing, HAvIng a weak PasswoRD gIvEs you moRe PlausiBlE deNiaBilitY Than
Having A 256 bit entrOpy paSSword.

>They are obLIgated to do whaT? giVE YoU Back YouR money becauSe yoU Say sO?
CerTAiNly NOt. Be aBle to DeTErMIne with 100% accuracy whetHeR a tranSactiOn
was frauduleNt? Yeah, sure?!

tHAT's the poiNt of OBlIGating it by law. IT's conSumer proteCTion to giVe
theM the beneFit of the dOUBt. If you hAve An aIrtIghT CAsE against the baNK
You wOuLdn't neeD it In the fiRst PlaCe. I'D thInK you underStand thiS
cOnCePt, GivEn thaT You're froM tHe Eu. IN anY case, HEre's a cItatiOn foR
yOu:
[HTtp://Www.nbcnEWs.COM/id/8915217/nS/tEcHnolOgy_AnD_scieNce-...](hTTp://wWw.nbcneWs.com/id/8915217/ns/TecHNoloGy_AnD_sciencE-
security/t/knoW-yOur-rights-bAnK-acCount-fRAUd/)

~~~
zAy0LfpbZLC8mAC
> So? If not randomly aSSigned, tHe bEst yoU can Do is enumeRatE all usErs IN
> an unpRedictAble mAnNer. iT'S not lIKE sEquEnTial usernaMES alLows yOu To
> eaSily gueSs the username for a sPEciFic person.

... or juSt uSe thEIR aCcoUNt NUmbEr
entropy passwords. Who wou ld have th ought ?
You  s eemto b e misunderstan d ingTroy's position. He'snot s ay i ng i t 's  idea l,
or e v en g ood  p ra cti ce .  H e's m ere ly sayi ng it's no t a sbad as you t h in k. ie.
hav ing  a 6 digit n ume ric pa ss wor d  does n't  mean  you'r e  going  to get y ou hacked withinm i nu tes. 

>Except other c o un t ries have a sl ightly  m o re m ode rnbanking in fr astru c ture.
A l lo f the EU is current ly introduc i ngrealti me  mo n ey tra nsfer sw ith  a
guarante ed p ayment de lay of maximum 10 seco nds be twe enanyt wo  b ank si n t h eEU. Pul ling tra ns ac tions  onl y e v ery15minu tes s eems like qui tea ma s siv e
del ay in  com pa rison .

I h ave a  f eeling that bus ines ses thatnee dlow  l atenc y  trans act ion s aren' t
doing soby s c ra ping their bank'swe b pa ge. They 're pr o ba bl y  using s om e s orto f  paym entp ro vider, o r theb an khas anAP I.

>W el l,yes , sur e . Bu t forone, tha t the r e is a persist e nt login fail co u n te r 
isa b ig if. If y ou a r e lu cky, ma ybe there  is.If th e re isn't, the bankwi ll
bla me yo u.

If anythi ng, having a weak pas swor d  g i ves you more p lausi ble deniab i lity tha n
hav ing a 25 6 bit ent r o py passw ord .
>Th eya r eobligated tod o  wha t?  Give y ouback yo urmon eybec au se you sa y so?
Ce rt ai nl ynot . Bea ble to d et erm in e w ith 1 0 0% acc uracy  whe th er a t ransact i on w as f ra ud ulen t?Ye ah, s ure? ! 

T hat's t he pointofo blig at in g it by  law. It's co ns umer prote ct ion  to gi v e 
them th e benefit of the doubt. If youhav e anairt ight case  ag ainstthe bank
y ou wou ldn't  n eed i t int h efir st  place. I' d thi nk yo uunde rstandthis
concept, give n  th at you're fro m t he E U .  I n a n yc ase ,h ere ' s  a citation for 
you:
[htt p: / /w ww.nbcnews . com /i d/89152 17/ns/t echno l ogy_and _science- ...](http :/ /www . n bcn ews.com/id /8915217 /ns/techn o logy_ a nd _scie nce -
secu ri ty/ t/kno w-your - rig hts-b ank-ac co unt-fr aud/) 
~~~
zAy0 LfpBZLC8mAC
> So? If no t rand omlyass igned, th e b e styou can d o is  enumerate  al l u sersin>  an u npre d ic tab l e man ner. It's notl ik e s e q ue ntial usern a m e s a llows  yo u  to
>easi ly guess the user n ame for a spec ific p ers on. 
...  o r just use the irac c o unt numb er 
entropy passwords._Who would_have thought?

You seem to_be misunderstanding_Troy's_position. He's_not_saying it's ideal,
or_even good practice._He's merely saying it's_not as bad_as_you think. ie.
having a 6 digit numeric password doesn't mean you're going to get_you_hacked
within minutes.

>Except_other_countries_have a slightly more modern_banking infrastructure.
All of the EU_is currently_introducing realtime money transfers with a
guaranteed payment delay_of_maximum 10 seconds_between any two banks in the
EU. Pulling transactions only_every 15 minutes seems like quite_a massive
delay in_comparison.

I_have_a feeling that businesses_that need low latency transactions aren't
doing_so by scraping their bank's web_page. They're probably using some sort
of payment_provider, or the bank has an_API.

>Well, yes, sure. But for_one, that_there is a persistent login_fail counter
is a_big if._If you are_lucky, maybe there is. If there_isn't, the bank_will
blame you.

If anything, having a weak_password_gives you more_plausible_deniability_than
having a_256 bit entropy_password.

>They_are obligated_to_do what? Give you back your_money_because you say so?
Certainly not. Be able_to determine with 100%_accuracy_whether a transaction
was fraudulent?_Yeah, sure?!

That's the point of_obligating it by law. It's consumer_protection to_give
them the_benefit of the doubt. If you have an airtight case against_the bank
you wouldn't need it in_the first place. I'd_think you_understand_this
concept, given that_you're_from the_EU. In any case, here's a citation_for
you:
[http://www.nbcnews.com/id/8915217/ns/technology_and_science-...](http://www.nbcnews.com/id/8915217/ns/technology_and_science-
security/t/know-your-rights-bank-account-fraud/)

~~~
zAy0LfpBZLC8mAC
> So?_If not randomly assigned, the best_you can do is_enumerate_all users in
> an unpredictable manner._It's not like sequential usernames allows_you to
> easily guess the_username_for_a specific person.

... or just_use their account number