3 ms·

That seems to be the least objectionable to me. You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever,

by SamBam 7y ago

That seems to be the least objectionable to me. You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?"

nybble41 7y ago
> You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." You could just make brute-force searches unproductive, for example by requiring a hardware security key or client certificate rather than a mere password or PIN. Good luck brute-forcing a 128+-bit random secret. > When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?" The state of the system was modified when an unauthenticated (never mind unauthorized) individual managed to run up charges on your account using only your credit-card number—which is "sensitive" information but not actually secret. That should not have been permitted in the first place. If the rule had been applied properly then this remedial step would not have been necessary.
zAy0LfpBZLC8mAC 7y ago
> You need to have some protection against brute-forcing. Yes, that protection is called "password". > Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." Which is why you should not limit the rate of guessing (or at least offer that option--limiting the rate of guessing does help users who use terrible passwords, after all). > Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?" Which is exactly why that shouldn't be a thing. Being able to pay with a semi-public number is just stupid. You should have to authenticate using a strong password, and "stealing credit card numbers" simply wouldn't be a thing anymore.
- SamBam 7y ago
  > Yes, that protection is called "password". [...] Which is why you should not limit the rate of guessing Any password can be brute-forced if you neither limit the number of guesses nor limit the rate that you can guess them.
  - zAy0LfpBZLC8mAC 7y ago
    No, it can't. If you are willing to say that a cow can not jump over the moon, then a strong password can not be brute-forced, even though it might theoretically be possible for a cow to quantum-tunnel over the moon, and it might theoretically be possible that an attacker guesses your password. The probability is so vanishingly small that you would call it impossible in any other context.
exabrial 7y ago
Credit card numbers are a great example of an attacker being able to modify the state of a system. The whole implementation is broken beyond belief. Why doesn't a purchase require a password, at the very minimum?

by SamBam 7y ago

nybble41 7y ago

> You need to have some protection against brute-forcing. Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." You could just make brute-force searches unproductive, for example by requiring a hardware security key or client certificate rather than a mere password or PIN. Good luck brute-forcing a 128+-bit random secret. > When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?" The state of the system was modified when an unauthenticated (never mind unauthorized) individual managed to run up charges on your account using only your credit-card number—which is "sensitive" information but not actually secret. That should not have been permitted in the first place. If the rule had been applied properly then this remedial step would not have been necessary.

zAy0LfpBZLC8mAC 7y ago

> You need to have some protection against brute-forcing. Yes, that protection is called "password". > Whether it's limiting the rate of guessing or whatever, the attacker is still "modifying the state of a system." Which is why you should not limit the rate of guessing (or at least offer that option--limiting the rate of guessing does help users who use terrible passwords, after all). > Indeed, that's a weird rule. When someone stole my credit card number and ran up charges, my bank called me to verify them. How was that not "modifying the state of a system?" Which is exactly why that shouldn't be a thing. Being able to pay with a semi-public number is just stupid. You should have to authenticate using a strong password, and "stealing credit card numbers" simply wouldn't be a thing anymore.

SamBam 7y ago
> Yes, that protection is called "password". [...] Which is why you should not limit the rate of guessing Any password can be brute-forced if you neither limit the number of guesses nor limit the rate that you can guess them.
- zAy0LfpBZLC8mAC 7y ago
  No, it can't. If you are willing to say that a cow can not jump over the moon, then a strong password can not be brute-forced, even though it might theoretically be possible for a cow to quantum-tunnel over the moon, and it might theoretically be possible that an attacker guesses your password. The probability is so vanishingly small that you would call it impossible in any other context.

exabrial 7y ago

Credit card numbers are a great example of an attacker being able to modify the state of a system. The whole implementation is broken beyond belief. Why doesn't a purchase require a password, at the very minimum?