It matters because you need to consider the attacker's motivations, goals, and resources.
>You are assuming the username is randomly assigned.
So? If not randomly assigned, the best you can do is enumerate all users in an unpredictable manner. It's not like sequential usernames allows you to easily guess the username for a specific person.
>Wut? For one, how is being denied access to your capital for ten minutes in any way "solving" the DoS risk? Then, how does that even solve anything if the attacker simply disables your account again within a few seconds?
It solves the DoS risk because it makes subsequent attacks sufficiently hard to perform afterwards. If your username can be leaked within seconds, the attacker probably has access to perform more devastating attacks than a simple DoS.
>You usually can't change your username, so you can not change that "password" to something the attacker doesn't know.
You might not be able to change your username online, but support can probably change it.
>You have it all backwards? The sensitive part is what is called the password. If your username is sensitive, you are already doing it all wrong. Especially because, see above, you can change your password, you can not (usually, easily) change your username-pretending-to-be-your-password.
Yes, usernames are supposed to be identifiers only, but keeping it a secret from your enemies isn't particularly hard. Please explain how the attackers are getting a hold of your username in the first place.
>You have heard of this thing called a bot net, right?
Here's why you need to consider the threat model. If it's some guy out for the lulz, using a botnet incurs a cost (both in terms of actual risk in terms of detection, and opportunity cost in terms of other things he could be using it for eg. credit card fraud, DDoS for fire, etc.). And the guy is willing to expend unlimited resources, then all bets are off. He could use amplification attacks to take down the bank's website by raw bandwidth alone. Worst case the bank mails/emails everyone new high entropy usernames.
>Also, congrats, you have just introduced the next DoS risk: If you happen to use an ISP where your IPv4 connectivity is only through NAT, and given that most banks are IPv4-only, suddenly, some random customer of that ISP, or the malware on their machine, can disable your access to your account.
Strange. I can log into my financial accounts while using VPN without a problem. You'd think that a VPN service that anyone can sign up for anonymously would invite more abuse than an ISP that you need to provide real credentials for.
>You know what would actually solve that problem? Wait for it ... it's passwords! Like, proper, real, high-entropy passwords. Who would have thought?
You seem to be misunderstanding Troy's position. He's not saying it's ideal, or even good practice. He's merely saying it's not as bad as you think. ie. having a 6 digit numeric password doesn't mean you're going to get you hacked within minutes.
>Except other countries have a slightly more modern banking infrastructure. All of the EU is currently introducing realtime money transfers with a guaranteed payment delay of maximum 10 seconds between any two banks in the EU. Pulling transactions only every 15 minutes seems like quite a massive delay in comparison.
I have a feeling that businesses that need low latency transactions aren't doing so by scraping their bank's web page. They're probably using some sort of payment provider, or the bank has an API.
>Well, yes, sure. But for one, that there is a persistent login fail counter is a big if. If you are lucky, maybe there is. If there isn't, the bank will blame you.
If anything, having a weak password gives you more plausible deniability than having a 256 bit entropy password.
>They are obligated to do what? Give you back your money because you say so? Certainly not. Be able to determine with 100% accuracy whether a transaction was fraudulent? Yeah, sure?!
That's the point of obligating it by law. It's consumer protection to give them the benefit of the doubt. If you have an airtight case against the bank you wouldn't need it in the first place. I'd think you understand this concept, given that you're from the EU. In any case, here's a citation for you: http://www.nbcnews.com/id/8915217/ns/technology_and_science-...