Hacker News Reader

Comment by Retric | Hacker News Reader

Wait, 0.06%/day * 365 ~= 21.9% per year. And they think that's a good thing? How about a ~50/50 chance your account will be compromised every 2.5 years?

PS: Ok, 1-(1-.0006)^(2.5 *365) = 42% but that's still terrible odds IMO.

View on HN

It's still 0.06% of all logins per year. You have to multiply 365 by the 1 billion logins every day, too, not just the 600K fraudulent ones.

What's important is the number of accounts compromised not the number of successful logins. I doubt their numbers are all that accurate, and some accounts are probably compromised several times a day etc, but I can't see how you can look at those numbers and things "this is a good thing".

The number of accounts compromised (or really, the number of times an account is compromised) has to be put in context. The context is the number of logins per unit time. So, I think they're both important.

And I don't think anyone is saying that any number of compromised accounts is a good thing. I question how much control Facebook has, though, given that many people will inevitably have passwords such as "abcd1234."

I agree you need context, but login's is only meaningful logging in where to compromise an account. If the issue is brute forcing passwords then time is the only meaningful context. As to passwords, it's easy enough to prevent overly common passwords just prevent someone from using overly easy to guess passwords, and throttling failed loggins for a given act to 20 / hour per IP makes dictionary attacks all but useless anyone without a bot net.

You can't treat each day as an independent random event: if a user has a weak password (e.g. "password1") then they may be compromised multiple times in a year.

Sure, but also have less than 1 billion active accounts. Anyway, I am more reacting to "this is the best way you can make these number look?" vs. some real estimate of the number of compromised accounts.

Reply on news.ycombinator.com