4 ms·
Serious question... if there are 3-5 attempt lock out, would this be any less secure than randomly generated number?
by pcurve 9y ago
Serious question... if there are 3-5 attempt lock out, would this be any less secure than randomly generated number?
- wtfequifax 9y agoNot sure I'd count on them having lock out, and even if they do, a shitload of the PINs will be easy to guess since they'll be clustered around now, when many people are rushing to lock their credit.
- mkagenius 9y agoYes -- if lot of people freeze their accounts on a day and the attacker has a way to try same pin on lot of accounts. (No -- if random number generator is only 2 digits long)
- didgeoridoo 9y ago1) Target individual for identity theft. 2) Search their twitter history for "I just froze my credit" or similar. 3) Try the PIN corresponding to t-1, t-2... t-5. 4) Profit!
- mikeash 9y agoVery much so. If you can guess when someone froze their stuff to within a day, for example, then 5 tries gives you a 1 in 288 chance of getting in. A proper random number would be more like 1 in a trillion trillion trillion trillion trillion trillion trillion trillion.