5 ms·
I often wonder why not all websites (especially delicate ones like ebanking) do not show the number of failed login attempts since last successful login. That
by n1000 7y ago
I often wonder why not all websites (especially delicate ones like ebanking) do not show the number of failed login attempts since last successful login.
That would raise awareness with users (ok, maybe scare some people) and give me some hints that my account may be under attack...
- overcast 7y agoThat's actually a great idea. Or how about a simple statistics email with a chart over time?
- rwmj 7y agoParticularly as they need to internally collect that information to comply with PCI (which requires financial orgs to lock accounts after 6 failed login attempts).
- askafriend 7y agoThis is the type of thing that sounds like a good idea in isolation but would be terrible in aggregate and over a long period of time.
- atoav 7y agoEven better: just show the last logins (both successful and failed). This way it also gives you a positive feel of security, because you can also see if e.g. a family member logged in etc.
- cat199 7y ago> (ok, maybe scare some people) This is probably why. The signal/noise ratio of people freaking out about 'their account being hacked' or 'bank xyzs terrible security because so many people hack my account every week' would probably completely overwhelm the security benefit. E.g: '10 failed logins? why are you letting other people try to log into MY account???' etc. Only way I could see this working is with industry wide support and a mass awareness campaign, and even then people would be annoyingly confused. (possibly worthwhile though)
- segmondy 7y agoUnless you have a very unique login, you are going to often seen login attempts. Common names such as john, john123, john234, johnq, qjohn will happen more often especially for a big site. This will probably give rise to support calls to the bank...
- choward 7y agoThen you'll learn that your username is one that's under attack and that it's even more important to have a strong password. Put some useful documentation on the login page that explains it. What's wrong with that?
- segmondy 7y ago2FA and be done with it.
- levythe 7y ago2fa is not magical. It makes an attack require more complexity, but it's not an "and be done with it," solution.
- lazzlazzlazz 7y agoHave you seen how severely 2FA drops the rate of unauthorized accesses? It's incredible. What have you seen that moves you to hedge on the value of 2FA?
- u801e 7y agoFor one thing, the SIM swap attack [1] [1] https://krebsonsecurity.com/tag/sim-swap/ https://krebsonsecurity.com/tag/sim-swap/ In general, relying on a second factor whose security practices aren't the best, could actually compromise security compared to having a strong and unique password. I personally wish that more banks would support 2FA authentication using a username/password in combination witH TLS client side certificates.
- patio11 7y agoBecause this would result in tens of millions of calls to the CS team to the general effect of "OMG someone is trying to hack my account!!! Do something!" to no purpose and decrease the adoption of a technology which materially increases per-user revenue and decreases per-user costs.