3 ms·

> Yes and no, passwords are an implementation detail. Passwords are not an "implementation detail" unless they are hardcoded (and a hardcoded password is very

> Yes and no, passwords are an implementation detail. Passwords are not an "implementation detail" unless they are hardcoded (and a hardcoded password is very arguably security by obscurity). > There’s a reason why bank cards can securely use 4 digit numeric pins but banking websites need much longer passwords. Yes, because the bank card provides some additional form of authentication, typically in the form of a chip on the card.

Retric 4y ago
Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic. You need a carefully constructed system to make the use of passwords viable.
- cmeacham98 4y ago
  > Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic. The same happens with websites, have you never been locked out of a website (or had your IP temp banned) for failing too many login attempts? Again, the reason that bank cards only require a PIN from you is that _the card_ provides the other half of the credentials. If a bank card simply contained the equivalent of a username (say your legal name and address), then it would not use just a PIN.
  - Retric 4y ago
    A temporary ban is just a rate limit by another name. Blocking IP’s is all well and good expect you can multiple attempts * thousands of IP’s means a 4 numeric digit password would literally always get cracked.
  - Xylakant 4y ago
    The reason you can get away with a 4 digit PIN is that you can only try the PIN if you’re in physical possession of the card. And if an attacker is already in physical possession of the card, you want revoke the card in any case. Web sites however, cannot just revoke the username - it would allow for trivial denial of service attacks. I could just enumerate all account numbers for my bank and lock out all customers. So the best that’s available is a temporary lockout, and then the attacker gets to try again.
    - quickthrower2 4y ago
      Plus all you can lose is money (not privacy / control / data) and the CC companies take the hit as cost of doing business.

Retric 4y ago

Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic. You need a carefully constructed system to make the use of passwords viable.

cmeacham98 4y ago
> Not quite. Bank cards can be revoked after unsuccessful attempts while doing that with usernames is problematic. The same happens with websites, have you never been locked out of a website (or had your IP temp banned) for failing too many login attempts? Again, the reason that bank cards only require a PIN from you is that _the card_ provides the other half of the credentials. If a bank card simply contained the equivalent of a username (say your legal name and address), then it would not use just a PIN.
- Retric 4y ago
  A temporary ban is just a rate limit by another name. Blocking IP’s is all well and good expect you can multiple attempts * thousands of IP’s means a 4 numeric digit password would literally always get cracked.
- Xylakant 4y ago
  The reason you can get away with a 4 digit PIN is that you can only try the PIN if you’re in physical possession of the card. And if an attacker is already in physical possession of the card, you want revoke the card in any case. Web sites however, cannot just revoke the username - it would allow for trivial denial of service attacks. I could just enumerate all account numbers for my bank and lock out all customers. So the best that’s available is a temporary lockout, and then the attacker gets to try again.
  - quickthrower2 4y ago
    Plus all you can lose is money (not privacy / control / data) and the CC companies take the hit as cost of doing business.