3 ms·
The only thing that would make 000 less secure in this setting would be if the actual CVC codes weren't randomly generated by the bank. Otherwise 000 has as muc
by doe88 8y ago
The only thing that would make 000 less secure in this setting would be if the actual CVC codes weren't randomly generated by the bank. Otherwise 000 has as much likelihood to be accepted/rejected than any other codes. Conversely, one could argue that if CVC codes were chosen or could be modified by the owner of the card then disabling the use of 000 could be understandable as lazy users would choose this weak code more often than any other numbers. Also, at the extreme say a merchant starts rejecting all kinds of values, and the attacker knows them, it may also affect its security by narrowing its space of valid values therefore increasing the probability to randomly find the right code.
- Dylan16807 8y agoIt's the bias in guessing that matters, not the bias in generation. If nobody ever guessed 000, or it was guessed exactly 0.1% of the time, it wouldn't be insecure for 90% of people to have a secret number of 000. At the other extreme, if 90% of people guess 000, then it's insecure to have a secret number of 000, even if it was perfectly randomly generated. People can learn about biases in generation, and use that to inform their guesses. So biases in generation indirectly matter. But inherent biases in guessing are just as important. Being a perfect RNG is not enough if your keyspace is small.
- doe88 8y agoYou have a valid point indeed.