3 ms·
The challenge is that if a system only offers a four or a five number passcode, you can still attack accounts by just guessing passcodes for account names/numbe
by pridkett 7y ago
The challenge is that if a system only offers a four or a five number passcode, you can still attack accounts by just guessing passcodes for account names/numbers. This is addressed a little bit by pointing out that it’s sometimes not easy to enumerate accounts - but if you’re malicious and have purchased a list of compromised accounts, you could then pound the system from a botnet even after the passwords have been changed. In this case you’re not concerned about a _specific_ account, but rather you’re concerned about _any_ account. And with a 4 or 5 number passphrase, you’d get hit pretty quickly.
- philliphaydon 7y agoIf you knew the bank and the account, you could assume that people login to their account atleast once a month. So every month you could try a combination. Known passcodes could be tried first. If a dump also has the person Birthday then their birth year is a good Guess for a 4 digit pass code. 2 failed attempts reset when the user succeeds their login during the month. There’s so many things people could do. Limiting passwords is a bad idea :/