4 ms·

> 3 trys - thats it. Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad in

> 3 trys - thats it. Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum. > 5 lower case letters is ~12 million bits of entropy, That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000. > again, as the article says, "Banks like ING will give you your money back". they have skin in the game and will refund your fraudulent charges. So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that?

kryogen1c 7y ago
>> 5 lower case letters is ~12 million bits of entropy, >That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000. woops! youre totally right. added an edit. >ad infinitum. this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. >So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that? You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.
- zAy0LfpBZLC8mAC 7y ago
  > this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. Except no lockout happens in this case? > You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed. And what do you do when your bank tells you that they can't see any sign of fraud?
  - gruez 7y ago
    >Except no lockout happens in this case? You're assuming that the lockout counter resets on successful login. Maybe there's a daily failed login counter.
    - zAy0LfpBZLC8mAC 7y ago
      Well, maybe? But for one, that's a big maybe, but also, it does not fundamentally change the fact that an attacker has more than three tries, or whatever the official limit is.
      - nybble41 7y ago
        And being able to lock arbitrary people out of their accounts is also a form of attack.
  - css 7y ago
    https://www.federalreserve.gov/supervisionreg/regecg.htm https://www.federalreserve.gov/supervisionreg/regecg.htm
  - RHSeeger 7y ago
    Or what do you do when you can't pay your rent/mortgage because the bank hasn't returned your money yet. All that convincing doesn't happen instantly.
raesene9 7y ago
On the attacker's extra tries. that's assuming a straight username/password combo with no additional data. For UK banks at least, I can't think of a single one that's only username/password. The better ones are 2FA, the less advanced ones will at least have something like username+password+"some kind of secondary secret" so straight online brute force is unlikely to be successful. Also your attacker shouldn't know about the impending lockout, so unless they have some way of knowing when a user has logged in, they'll end up locking the account (well assuming username/password ofc)
- maccard 7y ago
  The more advanced ones that use 2fa are really only 1fa (at least the two I have accounts with). Both allow you to reset your 2fa using the username+password on an install of their mobile device.
vonmoltke 7y ago
> Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum. I don't understand how this is exploitable unless an attacker knows when a user logs in. Otherwise, how do they know when they have two tries again?
- zAy0LfpBZLC8mAC 7y ago
  Well, how about the attacker knows when the user logs in, then? That's not exactly sensitive information ... or at least it shouldn't be. There sure are plenty of ways of how that info could leak out. But also, an attacker might just not care? Just try to get into a vast number of accounts at a rate that generally, statistically, doesn't trigger lockout, and it might just be irrelevant that that triggers some lockouts here and there.
maccard 7y ago
I agree with all your points except the last; > If everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that? two times I've reported fraud to two different banks. I was sent a letter from them stating "you say you didn't make X transaction, please sign and date and return", and I got the money back, no further questions asked. I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud. (Both my values we're under 300 pounds, for whatever it's worth, and I've found out since thatits a royal pain to spend > 1000 pounds on a debit card without being pre approved for the transaction)
- zAy0LfpBZLC8mAC 7y ago
  > I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud. OK, so my point still stands then?! I mean, it's certainly true that banks will generally refund (and in many jurisdictions have to refund) if they can tell that the customer was defrauded, and they also generally won't inconvenience their customers over small amounts. But for one, you didn't say 100%, and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings. It's an easy business decision for a bank to immediately refund you 100 pounds if they expect to make more than 100 pounds from you by retaining you as a customer. It's very much not if you are asking them to refund you 100000 pounds. So, there is a bias in this mechanism that it primarily helps those who don't need it, but is of questionable reliability for those who really need it. Plus, even if you do get your life savings back, you can be sure that just asking them to refund you 100000 pounds will not do the trick. So, yeah, sure, banks will refund you more often than not. But my point was that that is not something you can really rely on when it actually matters, and I stand by that.
  - maccard 7y ago
    > and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance. I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid.

kryogen1c 7y ago

>> 5 lower case letters is ~12 million bits of entropy, >That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000. woops! youre totally right. added an edit. >ad infinitum. this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. >So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that? You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.

zAy0LfpBZLC8mAC 7y ago
> this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. Except no lockout happens in this case? > You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed. And what do you do when your bank tells you that they can't see any sign of fraud?
- gruez 7y ago
  >Except no lockout happens in this case? You're assuming that the lockout counter resets on successful login. Maybe there's a daily failed login counter.
  - zAy0LfpBZLC8mAC 7y ago
    Well, maybe? But for one, that's a big maybe, but also, it does not fundamentally change the fact that an attacker has more than three tries, or whatever the official limit is.
    - nybble41 7y ago
      And being able to lock arbitrary people out of their accounts is also a form of attack.
- css 7y ago
  https://www.federalreserve.gov/supervisionreg/regecg.htm https://www.federalreserve.gov/supervisionreg/regecg.htm
- RHSeeger 7y ago
  Or what do you do when you can't pay your rent/mortgage because the bank hasn't returned your money yet. All that convincing doesn't happen instantly.

raesene9 7y ago

On the attacker's extra tries. that's assuming a straight username/password combo with no additional data. For UK banks at least, I can't think of a single one that's only username/password. The better ones are 2FA, the less advanced ones will at least have something like username+password+"some kind of secondary secret" so straight online brute force is unlikely to be successful. Also your attacker shouldn't know about the impending lockout, so unless they have some way of knowing when a user has logged in, they'll end up locking the account (well assuming username/password ofc)

maccard 7y ago
The more advanced ones that use 2fa are really only 1fa (at least the two I have accounts with). Both allow you to reset your 2fa using the username+password on an install of their mobile device.

vonmoltke 7y ago

> Until the users logs in, then you have another two tries. Until the users logs in, then you have another two tries. Well, and so on, ad infinitum. I don't understand how this is exploitable unless an attacker knows when a user logs in. Otherwise, how do they know when they have two tries again?

zAy0LfpBZLC8mAC 7y ago
Well, how about the attacker knows when the user logs in, then? That's not exactly sensitive information ... or at least it shouldn't be. There sure are plenty of ways of how that info could leak out. But also, an attacker might just not care? Just try to get into a vast number of accounts at a rate that generally, statistically, doesn't trigger lockout, and it might just be irrelevant that that triggers some lockouts here and there.

maccard 7y ago

I agree with all your points except the last; > If everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that? two times I've reported fraud to two different banks. I was sent a letter from them stating "you say you didn't make X transaction, please sign and date and return", and I got the money back, no further questions asked. I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud. (Both my values we're under 300 pounds, for whatever it's worth, and I've found out since thatits a royal pain to spend > 1000 pounds on a debit card without being pre approved for the transaction)

zAy0LfpBZLC8mAC 7y ago
> I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud. OK, so my point still stands then?! I mean, it's certainly true that banks will generally refund (and in many jurisdictions have to refund) if they can tell that the customer was defrauded, and they also generally won't inconvenience their customers over small amounts. But for one, you didn't say 100%, and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings. It's an easy business decision for a bank to immediately refund you 100 pounds if they expect to make more than 100 pounds from you by retaining you as a customer. It's very much not if you are asking them to refund you 100000 pounds. So, there is a bias in this mechanism that it primarily helps those who don't need it, but is of questionable reliability for those who really need it. Plus, even if you do get your life savings back, you can be sure that just asking them to refund you 100000 pounds will not do the trick. So, yeah, sure, banks will refund you more often than not. But my point was that that is not something you can really rely on when it actually matters, and I stand by that.
- maccard 7y ago
  > and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance. I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid.