4 ms·
That's great until someone gets access to their user database and is able to crack every password in very little time. Increasing the key space (both through lo
by necubi 17y ago
That's great until someone gets access to their user database and is able to crack every password in very little time. Increasing the key space (both through longer passwords and more allowed characters) makes these sorts of attacks far more difficult.
And if you think it's unlikely that AmEx will ever lose control of their user database, you clearly have not been paying attention the last few years.
- Alex3917 17y agoCouldn't you just salt the user database with 100 fake accounts for every one real account, so that way as soon as someone tries to log into a fake account the bank knows its system has been compromised?
- dmoney 17y agoThey could block whatever location the fake account was accessed from, but the attacker could try one account each from lots of different locations (perhaps through a botnet). For this to be useful the bank would have to lock all account access from everywhere when a fake one was accessed.
- calcnerd256 17y agoat which point the only thing to say is "denial of service"
- staticshock 17y agoAdditionally, the mined usernames / passwords could still be used to brute force other banking / credit card web sites.
- pingou 17y agoInteresting idea, but you need to save in your database which accounts are fake accounts, so if an hacker get an access to the database he will get this information too, unless this information is saved elsewhere.