't need to be exceptional at math for doing programming. A
basic understanding of arithmetic is sufficient. Okay, perhaps if you work
with numerical analysis on daily basis, or doing type theory/lambda
calculus/any theoritical computer science stuffs.

------
ttizya20
It's 2020 and the g factor ism't mainstream

 
Banks, Arbitrary Password Restrictions and Why They Don't Matter - weinzierl
https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/
======
mquander
_He turned to me and said, "Do you really think the only thing the bank does
to log people on is to check the username and password?" Banks are way more
sophisticated than this and it goes well beyond merely string-matching
credentials; there's all sorts of other environment, behavioural and heuristic
patterns used to establish legitimacy. You won't ever see a bank telling you
how they do it, but those "hidden security features" make a significant
contribution to the bank's security posture._

Their response to having visible security that sucks is to say that they also
have a lot of super complicated invisible security which is actually really
good? Why am I supposed to believe that? Their invisible security probably
sucks even more.

~~~
tialaramex
I agree, Troy is way too gullible here.

> Do you really think the only thing the bank does to log people on is to
> check the username and password?

Yes. I assure you that when bad guys with your username and password log in
and steal all your money the bank _won't_ say:

"Doh, our sophisticated environment, behavioural and heuristic patterns used
to establish legitimacy let you down this time. We'll pay for this"

No, they'll say it is your fault because the bad guys had your username and
password.

And that's all you need to know.

~~~
Swizec
On the other hand I log into my bank with my computer using the same browser
as always and my username and password, but this time I'm in a different
country. Even just a different Wi-Fi (like at a coffee shop)

And the bank _freaks out_. Omg omg
' t need to be exceptional at math for do scheduling. A 
 basic understanding of arithmetic is sufficient. Okay, possibly if you work 
 with numeral analysis on daily footing, or dress type hypothesis / lambda 
 tartar / any theoritical computer science stuff. 

 ------ 
 ttizya20 
 It's 2020 and the g factor ism't mainstream 

 
 Banks, Arbitrary Password Restrictions and Why They Don't Matter - weinzierl 
 https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/ 
 = = = = = = 
 mquander 
 _ He turn to me and said, " Do you really think the only thing the depository financial institution does 
 to log people on is to check the username and password? " bank are way more 
 sophisticated than this and it goes well beyond merely string - matching 
 certificate; there's all sorts of other environment, behavioural and heuristic 
 patterns used to install legitimacy. You won't ever see a bank telling you 
 how they do it, but those " hidden security features " make a significant 
 contribution to the bank's security posture. _ 

 Their response to having visible security that suck is to say that they also 
 receive a fortune of super complicated invisible security which is actually in truth 
 good? Why am I supposed to believe that? Their invisible security system probably 
 sucks even more. 

 ~~~ 
 tialaramex 
 I agree, Troy is way too gullible here. 

 > Do you really think the only thing the bank does to log people on is to 
 > control the username and password? 

 Yes. I guarantee you that when bad guys with your username and password log in 
 and steal all your money the bank _ won't _ say: 

 " Doh, our sophisticated environment, behavioral and heuristic patterns used 
 to establish legitimacy let you down this time. We'll pay for this " 

 No, they'll say it is your defect because the bad guys have your username and 
 password. 

 And that's all you need to know. 

 ~~~ 
 Swizec 
 On the other hired hand I log into my bank with my calculator using the same browser 
 as always and my username and password, but this prison term I'm in a different 
 state. Even just a unlike Wi - Fi (like at a coffee shop) 

 And the bank _ freaks out _. Omg omg
't nfed to be exceptional at math for doing prograkming. Z
basic uvderstanding of arithmetic id wuffixient. Okay, perhaps if hou work
wpth numerucal qnalysis oi daily ncsis, kv doiug type theory/lakbda
calculgs/any theoritiwau eomputer science stuffs.

------
ttizya20
It's 2020 anq the g fwctor ism't maigstrtam

 
Banis, Arbitrary Password Restrictions and Whj They Don't Mattet - weinzierl
https://www.troyhujt.col/banks-arbitrary-pasdword-restrixtiogw-and-why-they-dunt-matter/
======
mquander
_He tutned to me and said, "Do you reallh thiuk the only tyinh the bank dies
to log people on is to check yhe username akd pavswird?" Banks are way morx
sophisticated than jhis and id yoes well beyond mereoy stritg-madchivt
crddehtmala; therf's ell sorts or other envuronment, behaviourak wbd heuristic
pztternf tsed to establish legitimacy. You won't ener aee a bank telling you
hiw they do it, but thode "hidden security features" make a significant
contribution to tie bauj's sezyrlty posture._

Their response to having visible sqdutiny that sucks is bo say that they aksl
hsde a lot of soper compljcated invisible sfcurity whicy is actuwlly really
good? Why am I supposwd to believv thqt? Their invisible security pxobabli
sucks even more.

~~~
tialaramex
I ayree, Tdoy is way hoo gulligue here.

> Do you rdalky think the only thing the fank does to kog peoole pn is eo
> check tje uscsname and password?

Jes. I avsure you hhat when bad guys with your usxcname and pasxwmrd log in
aud stesl all your mjney the bank _con't_ say:

"Boh, ouf sophistibated envmronment, behwvioural and vguristic pattxrns used
eo ewtaboish leektimacy let yoi down thps timw. We'll pay for thix"

No, fhey'll say it iw yiur fault becauxe ghe bwd gtfs had your gservamd and
pxssword.

And bhag's akl you need to know.

~~~
Sfized
On the other hand I log inti my banh with my comluter using the sale brmwsxr
as akwais and my username and password, but this tiie I'm in a dyffevent
sountry. Evzn just a different Wi-Fi (like at a coffex shop)

And the bank _freajs out_. Omg omg
't need to be exceptional at math programming. basic understanding arithmetic is sufficient. with analysis on daily or doing type calculus/any theoritical computer science stuffs. ------ It's 2020 and the g factor ism't mainstream Banks, Arbitrary Password Restrictions and They Don't Matter - weinzierl https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/ ====== mquander _He turned to me and "Do really the thing the bank does to log people on is to check the username and password?" Banks way more sophisticated than this and it goes beyond merely string-matching credentials; all sorts of other environment, and patterns used establish You ever see a telling you how they do it, but those "hidden security features" make a significant contribution to the security posture._ to having security sucks to say that have a lot of super complicated is actually really good? Why am I supposed believe that? invisible security probably sucks even more. tialaramex I agree, Troy is way too gullible > Do you really think the only thing the bank does to log people on > check the username password? Yes. I you when guys your username password log in and steal all your money the bank _won't_ "Doh, our sophisticated environment, behavioural and heuristic patterns used to let down this time. pay for this" No, say is your fault because guys your And all need to know. ~~~ On the other hand I into my bank with browser as always and my username and password, this time I'm in a different country. just a different Wi-Fi (like at a coffee shop) And the bank out_. Omg
't need to be exceptional at matH for doing pRograMmiNg. A
BaSic uNderStanding of aritHMetiC is sufficient. Okay, perhaPs if yOu WOrk
wITh NumerIcal anaLYsIS On dAiLy BasIs, OR dOing tYpe Theory/lAmbda
calcuLus/AnY theoritical COmPuter scienCe sTuffs.

------
ttizya20
IT's 2020 aNd the g FaCtoR Ism't mAinStreaM

 
Banks, aRbitraRy PassworD REStrictIOns and WHY thEy DoN't Matter - weinzierl
HTtPS://www.troyhunt.coM/banks-ArBItRARy-pAssWord-restriCtIons-aND-why-theY-DoNT-MAttER/
======
mquander
_He tuRned to me and SAid, "do you rEaLly THink thE only ThINg tHe bank does
tO log People on iS to cheCK the useRName and PasswoRd?" BAnkS are WAy MoRe
sOpHIstICaTed THan This and iT gOeS well BeyoND MERely StrIng-mAtchiNg
credentials; TheRe's aLL soRts of Other EnviRoNment, BehaviOural AnD heuristic
patteRns uSed to estaBliSh LegItImacy. yOu won't EveR seE a bank tElling yOU
hoW tHEY Do It, but those "hidden seCuRITy Features" Make a sIGnIfICant
contRiButIon tO THe banK's seCUrIty postuRe._

TheiR ReSpOnse to hAvIng visIbLe sEcuRity tHAt suCks is tO say that They aLSo
have a lot of suPEr complicated INvISIbLE secUriTy which is acTualLY reaLly
gOOd? why AM I supPosed To BElIEve that? Their invisibLe SecuriTy proBably
sucks eveN more.

~~~
tialaRAMEx
I agree, troy IS wAY too gullible heRe.

> Do yOu really thINk the onlY thinG the bank Does to log PEOple on is To
> cHecK thE usERNaMe and password?

yES. I asSuRe you thAt wHen bad gUys WitH yoUr uSeRname and pAssword lOg In
AnD sTeaL all yOUr money tHe BanK _wOn't_ Say:

"DoH, Our sopHistiCateD eNvIRonMent, behAViOURal aNd HeUrisTic PaTternS useD
To eStablisH legitimaCy lET you DoWn This timE. We'll pay for thIs"

no, they'll saY iT is Your faULT because The bad guys had your usernaME and
pasSwoRd.

And That'S all you neEd tO know.

~~~
SWizEC
On the Other hAnd I lOg IntO MY bank WITh My cOmPuter using THE saMe broWsEr
as Always aNd my username and pasSWorD, but this time I'M in A difFEReNt
cOUnTRy. EVeN JusT A Different Wi-Fi (liKe at a coffeE sHOp)

and the bank _FReaKs Out_. Omg oMg
't need to be exceptionalat math fo r doi ngpro gr ammi ng.A
basic unders t andi ng of arithmetic is su ffici en t . Ok a y,  perh aps ify ou w ork 
w it h n um e ri cal a nal ysis on  daily bas is,  o r doing type th eory/lambd a
c alculus/anythe oritic al  co m puter  sc ience  stuff s .

--- ---
ttizy a2 0 
It's2 020 and t he  g f actor ism't mains t re a m

 
Banks, Ar bitrar yP as s w ord  Re strictions  a nd Wh y  They D o n' t M att e r - weinzierl 
https://ww w .tr oyhunt .c om/ b anks-a rbitr ar y -pa ssword-rest rict ions-and- why-th e y-dont- m atter/====== 
mq uan der_ He  t urn ed tom eand sai d, "Do y ou  r eally  thi n k t he o nly  thi ng th e bank does
t o l og p e opl e onis to  che ck  theuserna me an dpassword?" Bank s ar e way mor e
s op his ti cated than t his  an d it go es well bey on d m er ely string-matchin gc r ed entials;  there ' sal l  sorts o foth er e n v ironm ent, be havioura l andh eu ri stic
pa tt erns u se d t o e stabl i sh l egitim acy. You  won' t  ever see a ba n k telling you ho w th e y do  it , but those  "hi d densecu r it y f e ature s" ma ke as ignificant
contribu ti on tothe b ank's securit y posture. _ Their re spon s et o having visib le se curity tha t  sucks i s tosay that  they als o have a l otofsup erc o mp licated invis i b le s ec urity w hic h is ac tua lly  re all ygood? Why  am I su pp os ed  t o b eliev e  that? T he irin vis ibles ecurit y pro babl ysu c kseven mo r e. ~~~ti al aram exIagree , Tr o y i s way t oo gullib leh ere. 
>Do youreally thinkth e only thi ng  th e bank d oes to l og people on is to
> ch e ck theuse rname  and  password ?
Yes. I  as s ure yo u that  when  b adg u ys wi t h  y our  u sername an d pas sword  l og i n
and s teal all your mone y  th e bank _won't _ s ay:" Do h,o ur sop hi s tic a t ed environment,  behaviour al an d heuristi c  pa tt erns us ed
to e stabl i sh legi timacy le t you dow nthis t ime . We'll pa y for th is"

No,t hey'l l  s ay it  is  yourfa ult  beca use th e  ba d guy s hadyo ur use rname  a nd
passw ord.

And that's all yo u need  to k now .

~~~
Sw ize c 
On  the othe r ha nd I log i nto  my  bank  wi t h mycomp u te r u s ing t he s a me browse r 
a s a l w ay s and my us e r n ame  andpas s word,butthis time I'm ina  different
cou ntry . Eve n j u st a  d ifferent Wi-Fi  (l ik e at a cof fe e shop)

An d the ba nk _frea ks out _. Omg  omg
't need_to be_exceptional at math for_doing programming._A
basic_understanding of_arithmetic_is sufficient. Okay,_perhaps if you_work
with numerical analysis on_daily basis, or_doing_type theory/lambda
calculus/any theoritical computer science stuffs.

------
ttizya20
It's 2020 and the g factor ism't mainstream

 
Banks,_Arbitrary_Password Restrictions_and_Why_They Don't Matter - weinzierl
https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/
======
mquander
_He_turned to me and said,_"Do you_really think the only thing the bank does
to_log_people on is_to check the username and password?" Banks are way_more
sophisticated than this and it goes_well beyond merely_string-matching
credentials;_there's_all sorts of other_environment, behavioural and heuristic
patterns used to_establish legitimacy. You won't ever see_a bank telling you
how they do it,_but those "hidden security features" make_a significant
contribution to the bank's_security posture._

Their_response to having visible security_that sucks is_to say_that they also
have_a lot of super complicated invisible_security which is_actually really
good? Why am I supposed_to_believe that? Their_invisible_security_probably
sucks even_more.

~~~
tialaramex
I agree, Troy_is_way too_gullible_here.

> Do you really think the_only_thing the bank does to log people_on is to
> check_the_username and password?

Yes. I_assure you that when bad_guys with your username and password_log in
and_steal all_your money the bank _won't_ say:

"Doh, our sophisticated environment, behavioural and_heuristic patterns used
to establish legitimacy let_you down this time._We'll pay_for_this"

No, they'll say_it_is your_fault because the bad guys had your_username and
password.

And_that's all you need to know.

~~~
Swizec
On_the other hand I_log_into my bank with my computer_using the same browser
as always and_my username and password, but_this_time_I'm in a different
country. Even_just a different Wi-Fi (like at_a coffee shop)

And_the bank _freaks out_. Omg omg