Tag Info

New answers tagged

1

One thing that some websites, like Google, seem to be doing to prevent this type of attack is to, after a certain amount of login attempts, not lock you out, but give you something called a CAPTCHA. This is used more to prevent bot logins, but it slows a malicious human user down, as well, as he/she still has to figure out the password, and some CAPTCHAs are ...


1

There is one key advantage to an assigned username or password - usually it's more random than a user would generate. For an 8 character numeric only username, there are 100 million (10^8) possible permutations. This is less than 1/3 of the population of the USA, and about 1/2 the population of Indonesia. So this method certainly would not scale to beyond ...


4

You could generate the passcode by taking a consecutive number and append one or more additional digits to it which are a checksum of the actual number. You can check the validity of a passcode on the client-side by checking if the checksum-digits entered by the user match the actual part of the passcode. One checksum-digit reduces the chance to ...


2

Web services can take into account the location of where log in requests are originating from and correlate with your past log in attempts. Similar to how credit card companies will contact you when they notice "unusual activity" on your credit card. This is one piece of logic a organization providing a service on the web can use to address incidents like ...


6

Banks that issue numeric usernames are rather annoying. And while I am more paranoid that most, you're probably right that someone just fat fingered their ID and didn't realize it until they locked you out. To answer the question, some banks do help ensure you are attempting to login with the correct user account. Those "Security Images" you see on some ...


5

They prevented an attack on your account. This is a desired outcome - had they been able to try unlimited passwords, they'd have guessed yours. The attack was stopped in time, costing you a minor inconvenience. If this pattern was repeated in order to seriously inconvenience you, the bank can simply issue you a new random passcode. They aren't as ...


2

As well as the above answers, it's also to prevent people hopping onto your computer if you're away from your machine. For example, if Bob signs into his online banking in his workplace, then decides to grab a coffee without locking his workstation first; then anyone could walk past and jump straight into his bank account. With the X minute expiration/log ...


6

It's for your security. This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account. This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it ...


2

Session expiry is incorporated into applications to safeguard the user from session hijacking or cookie thefts. Not all users are tech savvy and might not understand what session hijacking or cookie thefts are.So forcing the users to login every few minutes of inactivity is for safeguarding the users information. Banking applications use cookies and ...


4

This is mainly to prevent session fixation attacks - if old sessions are thrown away regularly, the less valuable are hijacked sessions (http://en.wikipedia.org/wiki/Session_fixation). I think another reason for the bank sites performing this way is to give users a secure feeling - most of them aren't technically skilled people and this auto-outlogging ...



Top 50 recent answers are included