Hacker News Reader

Comment by n1000 | Hacker News Reader

I often wonder why not all websites (especially delicate ones like ebanking) do not show the number of failed login attempts since last successful login.

That would raise awareness with users (ok, maybe scare some people) and give me some hints that my account may be under attack...

View on HN

> (ok, maybe scare some people)

This is probably why. The signal/noise ratio of people freaking out about 'their account being hacked' or 'bank xyzs terrible security because so many people hack my account every week' would probably completely overwhelm the security benefit. E.g: '10 failed logins? why are you letting other people try to log into MY account???' etc.

Only way I could see this working is with industry wide support and a mass awareness campaign, and even then people would be annoyingly confused. (possibly worthwhile though)

Unless you have a very unique login, you are going to often seen login attempts. Common names such as john, john123, john234, johnq, qjohn will happen more often especially for a big site.

This will probably give rise to support calls to the bank...

Then you'll learn that your username is one that's under attack and that it's even more important to have a strong password. Put some useful documentation on the login page that explains it. What's wrong with that?

2FA and be done with it.

2fa is not magical. It makes an attack require more complexity, but it's not an "and be done with it," solution.

Have you seen how severely 2FA drops the rate of unauthorized accesses? It's incredible. What have you seen that moves you to hedge on the value of 2FA?

For one thing, the SIM swap attack [1]

[1] https://krebsonsecurity.com/tag/sim-swap/

In general, relying on a second factor whose security practices aren't the best, could actually compromise security compared to having a strong and unique password.

I personally wish that more banks would support 2FA authentication using a username/password in combination witH TLS client side certificates.

SIM swap is not scalable. It exists, but the scale of attacks through SIM swap is not even remotely comparable to credential stuffing.

Requires forcing every PC case and laptop sold to have a slot for smart cards. Otherwise it is too inconvenient.

You could just put it in the certificate store on the machine rather than relying on external storage.

That's actually a great idea. Or how about a simple statistics email with a chart over time?

Particularly as they need to internally collect that information to comply with PCI (which requires financial orgs to lock accounts after 6 failed login attempts).

Because this would result in tens of millions of calls to the CS team to the general effect of "OMG someone is trying to hack my account!!! Do something!" to no purpose and decrease the adoption of a technology which materially increases per-user revenue and decreases per-user costs.

Even better: just show the last logins (both successful and failed). This way it also gives you a positive feel of security, because you can also see if e.g. a family member logged in etc.

This is the type of thing that sounds like a good idea in isolation but would be terrible in aggregate and over a long period of time.

Could you explain why? It’s not immediately evident to me...

It would freak Grandma the hell out even if she has a strong password.

This would, in turn, cause a lot of panicked calls to the bank.

Reply on news.ycombinator.com