4 ms·

>> 5 lower case letters is ~12 million bits of entropy, >That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000. woops! youre

>> 5 lower case letters is ~12 million bits of entropy, >That's more like 23.5 bits, which, as far as I know, is quite a bit less than 12000000. woops! youre totally right. added an edit. >ad infinitum. this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. >So, if everything looks like you authorized a transaction, they'll give you your money back because you said so? And you seriously believe that? You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed.

zAy0LfpBZLC8mAC 7y ago
> this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. Except no lockout happens in this case? > You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed. And what do you do when your bank tells you that they can't see any sign of fraud?
- gruez 7y ago
  >Except no lockout happens in this case? You're assuming that the lockout counter resets on successful login. Maybe there's a daily failed login counter.
  - zAy0LfpBZLC8mAC 7y ago
    Well, maybe? But for one, that's a big maybe, but also, it does not fundamentally change the fact that an attacker has more than three tries, or whatever the official limit is.
    - nybble41 7y ago
      And being able to lock arbitrary people out of their accounts is also a form of attack.
- css 7y ago
  https://www.federalreserve.gov/supervisionreg/regecg.htm https://www.federalreserve.gov/supervisionreg/regecg.htm
- RHSeeger 7y ago
  Or what do you do when you can't pay your rent/mortgage because the bank hasn't returned your money yet. All that convincing doesn't happen instantly.

zAy0LfpBZLC8mAC 7y ago

> this is not true. banks take action and will not give you probably any more than 2 or 3 sets of lockouts before taking action. Except no lockout happens in this case? > You must not be from the US. To my knowledge, most banks will refund fraudulent purchases. in addition to being believable at face value, I have also personally had fraud charges reversed. And what do you do when your bank tells you that they can't see any sign of fraud?

gruez 7y ago
>Except no lockout happens in this case? You're assuming that the lockout counter resets on successful login. Maybe there's a daily failed login counter.
- zAy0LfpBZLC8mAC 7y ago
  Well, maybe? But for one, that's a big maybe, but also, it does not fundamentally change the fact that an attacker has more than three tries, or whatever the official limit is.
  - nybble41 7y ago
    And being able to lock arbitrary people out of their accounts is also a form of attack.
css 7y ago
https://www.federalreserve.gov/supervisionreg/regecg.htm https://www.federalreserve.gov/supervisionreg/regecg.htm
RHSeeger 7y ago
Or what do you do when you can't pay your rent/mortgage because the bank hasn't returned your money yet. All that convincing doesn't happen instantly.