3 ms·

The 5 number 3 tries bank does not seem very secure: It is (at least in my country) very easy to guess valid acount numbers: They are incrementally numbered

The 5 number 3 tries bank does not seem very secure: It is (at least in my country) very easy to guess valid acount numbers: They are incrementally numbered + have a checksum. So while 1 account of a 5 number 3 tries bank is safe, attacking all of them in volume is not: With N numbers, T tries, A accounts, the chance of guessing at least 1 account is pow(1-T/pow(10,N),A) 5 numbers 3 tries means a chance of 0.9997 of being locked out of 1 account. For A=100 000 accounts, the chance is 0.049, so more than 95% chance you guessed one account right. For A=1 000 000, you're almost certain. And that's the dumbest possible way. Try guessing with the most common password like 12345, take only 1 try each month so people unknowingly reset the account number when doing payments, and use a botnet to spread the load over tons of IP adresses and randomize the numbers.

SamBam 7y ago
Exactly. The math is not in their favor at all if the attacker is able to work out or guess numerous account numbers.
- bscphil 7y ago
  I think this is exactly right. My bank has predictable account numbers too, and if they had one of these 4 or 5 digit password limitations, they would be a very ripe target for someone using a botnet to just go through all the accounts. The risk isn't that someone will target you personally, the risk is that someone will happen to hit you while attempting the profitable activity of hacking every account. (Plus, at least with a bank, if they manage to hack in and steal the database, one of the most profitable ways to use it would just be to log in and steal money. No effective hashing on a 5 char password.) I also completely distrust the "advanced security measures" claim. I have no trouble logging into my bank via curl, including from remote IP addresses. (They finally rolled out 2FA, but I can still type the text code into my script.) A couple years ago I discovered a number of vulnerabilities in their account site, too (including some many years old software with vulnerabilities with a CVSS of 10). After I reported this to them, the response from the guy who worked there was basically "Yeah, that's from the crappy vendor who supplies us with this software. Please don't say anything about this because we're replacing it with a new in-house backend in a couple months."

SamBam 7y ago

Exactly. The math is not in their favor at all if the attacker is able to work out or guess numerous account numbers.

bscphil 7y ago
I think this is exactly right. My bank has predictable account numbers too, and if they had one of these 4 or 5 digit password limitations, they would be a very ripe target for someone using a botnet to just go through all the accounts. The risk isn't that someone will target you personally, the risk is that someone will happen to hit you while attempting the profitable activity of hacking every account. (Plus, at least with a bank, if they manage to hack in and steal the database, one of the most profitable ways to use it would just be to log in and steal money. No effective hashing on a 5 char password.) I also completely distrust the "advanced security measures" claim. I have no trouble logging into my bank via curl, including from remote IP addresses. (They finally rolled out 2FA, but I can still type the text code into my script.) A couple years ago I discovered a number of vulnerabilities in their account site, too (including some many years old software with vulnerabilities with a CVSS of 10). After I reported this to them, the response from the guy who worked there was basically "Yeah, that's from the crappy vendor who supplies us with this software. Please don't say anything about this because we're replacing it with a new in-house backend in a couple months."