4 ms·

you mean like only allowing 6-digit passwords without symbols?

throwawayReply 9y ago
If the consequence of my account being compromised is the bank adjusting the numbers in the ledger back then the bank are welcome to enforce such rules. If a bank said that customers were responsible for the money stored in the bank and that the bank could not undo transactions (from the POV of the genuine client) then we'd be demanding much stronger banking passwords.
- bfuller 9y ago
  The exchanges can just change a couple numbers in their database and reverse the hack... r-right?
  - throwawayReply 9y ago
    Yes, if people accept fractional reserve banking for bitcoin. I'd actually assume that's how most exchanges operate under the hood but many people who buy into bitcoin for ideological reasons won't accept that. A consequence of making that formal is that the total owned amount of bitcoin would be more than 21m, because the hacker would own bitcoin and the users would own bitcoin on the exchange. As long as there isn't a bank run, that discrepancy would not be a problem, but it would deflate the currency, also seen as unacceptable to bitcoin purists. edit: access -> accept.
    - notyourday 9y ago
      Oh, rubbish. Bitcoin is fundamentally incompatible with sanity and a rule of law ( which is what is needed for regulation ). If I were to start a bitcoin exchange ( and myself and those that I know have way more technical abilities to actually pull it off ) and apply sane KYC and risk mitigation strategies, the crypto-nutcases would be screaming like banshees that the exchange is not acting in a "spirit" of bitcoin which is: 1) Allow anyone to launder money/coins 2) Ask no questions 3) Make all transactions irreversible (i.e. do not follow 'in the name of' ledger ) 4) Demand no validated tax information (i.e. leverage power of the government to make players play by the rules )
- nikanj 9y ago
  Actually getting tens-hundreds of millions out of the traditional banking system is _hard_. Transactions can always be reversed, and you'll never pull out millions in cash without some serious questions asked.
matt4077 9y ago
That policy may appear unwise, but to judge banks' security, there is enough evidence available without resorting to any such theoretical model of what's secure and what's not. And that evidence is pretty clear. I do not remember any hacking incidents resulting in large-scale losses to consumer, so they seem to be doing something right.
mikeash 9y ago
Six-digit passwords are fairly secure when combined with strict limits on the number of attempts allowed, how much money can be withdrawn in one day, and heuristic fraud detection.
- adrianN 9y ago
  But is there any good reason to forbid users from choosing longer, more secure passwords while still limiting the number of attempts and doing heuristic fraud detection? You know, other than that sixty year old legacy system that stores your passwords in clear text and doesn't support any other format than six digits?
  - mikeash 9y ago
    That seems like a pretty good reason already.
  - user5994461 9y ago
    Card terminals only have numbers. Not planning to ship them with a full keyboard. That's a good reason to only take numbers.
    - Anarch157a 9y ago
      Not to mention that Indo-Arabic digits are almost universal, other characters are not. Picture a chinese or armenian with a password that uses characters from their respective alphabets trying to type it on each other's ATMs.
osteele 9y ago
This would be a significant vulnerability if bank customers were sophisticated at security, and if those passwords were the only input into their fraud detection systems.

If the consequence of my account being compromised is the bank adjusting the numbers in the ledger back then the bank are welcome to enforce such rules. If a bank said that customers were responsible for the money stored in the bank and that the bank could not undo transactions (from the POV of the genuine client) then we'd be demanding much stronger banking passwords.

bfuller 9y ago
The exchanges can just change a couple numbers in their database and reverse the hack... r-right?
- throwawayReply 9y ago
  Yes, if people accept fractional reserve banking for bitcoin. I'd actually assume that's how most exchanges operate under the hood but many people who buy into bitcoin for ideological reasons won't accept that. A consequence of making that formal is that the total owned amount of bitcoin would be more than 21m, because the hacker would own bitcoin and the users would own bitcoin on the exchange. As long as there isn't a bank run, that discrepancy would not be a problem, but it would deflate the currency, also seen as unacceptable to bitcoin purists. edit: access -> accept.
  - notyourday 9y ago
    Oh, rubbish. Bitcoin is fundamentally incompatible with sanity and a rule of law ( which is what is needed for regulation ). If I were to start a bitcoin exchange ( and myself and those that I know have way more technical abilities to actually pull it off ) and apply sane KYC and risk mitigation strategies, the crypto-nutcases would be screaming like banshees that the exchange is not acting in a "spirit" of bitcoin which is: 1) Allow anyone to launder money/coins 2) Ask no questions 3) Make all transactions irreversible (i.e. do not follow 'in the name of' ledger ) 4) Demand no validated tax information (i.e. leverage power of the government to make players play by the rules )
nikanj 9y ago
Actually getting tens-hundreds of millions out of the traditional banking system is _hard_. Transactions can always be reversed, and you'll never pull out millions in cash without some serious questions asked.

matt4077 9y ago

That policy may appear unwise, but to judge banks' security, there is enough evidence available without resorting to any such theoretical model of what's secure and what's not. And that evidence is pretty clear. I do not remember any hacking incidents resulting in large-scale losses to consumer, so they seem to be doing something right.

mikeash 9y ago

Six-digit passwords are fairly secure when combined with strict limits on the number of attempts allowed, how much money can be withdrawn in one day, and heuristic fraud detection.

adrianN 9y ago
But is there any good reason to forbid users from choosing longer, more secure passwords while still limiting the number of attempts and doing heuristic fraud detection? You know, other than that sixty year old legacy system that stores your passwords in clear text and doesn't support any other format than six digits?
- mikeash 9y ago
  That seems like a pretty good reason already.
- user5994461 9y ago
  Card terminals only have numbers. Not planning to ship them with a full keyboard. That's a good reason to only take numbers.
  - Anarch157a 9y ago
    Not to mention that Indo-Arabic digits are almost universal, other characters are not. Picture a chinese or armenian with a password that uses characters from their respective alphabets trying to type it on each other's ATMs.

osteele 9y ago

This would be a significant vulnerability if bank customers were sophisticated at security, and if those passwords were the only input into their fraud detection systems.