@mika That depends, if it blocks the users account after 3 attempts then it is a trivial method of DOS. Even blocking the IP will not help enough as it is easy to rotate IPs until one is unblocked (think bot net with tens of thousands of computers). Also IP blocking can become DOS, Image a large NATed network, if a single user fails to log in the entire network looses access.

@AstroDan almost all (not sure in this case but I sure hope) banking systems are set up with hard lockouts (3-5 attempts before a new password is required to be set after additional authentication, i.e. over the phone, or at the very least a 30 minute or more wait) so it's not out of the question to rely on that. Im definitely not saying this is good, but someone easily opening the account with a script running for a million iterations is highly unlikely.

@AstroDan Most sensible banks use a user name dedicated to online banking (some even assign these randomly), so there's nothing to brute force unless the customer reveals this info somewhere other than the bank's website. Many also use dual passwords with a delay after the first one, so a real user who knows both passwords can get in reasonably quickly, whereas an attacker will not have a chance to test enough passwords before the bank take action.

@JeffMeden True, but in my experience when you see a single bad sign like this there are worse ones lurking underneath.

If you enter the wrong password on my bank's system three times in a row (over any period), the account is locked out until you call up their support (24/7 thankfully). The weak link in this chain would probably be social engineering of some sort rather than worries about "oh no, pin too short". DoSing someone is probably also fairly easy...

my bank uses user id, date of birth and a 5 digit number. Note however that the user id is not on the credit card and they explicitly tell you not to give that number away. Adding those digits you arrive at something like 16 digit number...

@Bakuriu it is better, but the date of birth can be easily guessed or obtained.

And also, because it's 6 digits long, most users are going to use their date of birth or the date of birth of a close relative, making it even easier to guess it...

While it's not ideal, this is quite common for banks. Brute forcing is not as easy as people suggest, as any attempt will very quickly trigger an account lockout. After the account is locked, it'll require a phone call to reactivate the account.

Any hacker will get perhaps 5 random guesses, and that's it. Brute force is therefore not feasible.

Uhm... the max 3-5 login rule prevents a hacker from brute-forcing a specific user's password, but surely they can try random passwords with random usernames until they find a pair that works. Especially since those usernames are poorly chosen, too.

@Bakuriu: At my german bank they use the card number as the user id. The number consists only on digits and therefore a attacker could simply increment the number for each attack... You can change the user id to something else (which I did), but most people wont.

Note that my Dutch bank allows one to setup on app for phone or Ipad that then only requires a 5 number password to login, no username. The password even gives the power to transfer small amounts to accounts that you have previously paid money to or unlimited transfer between your own accounts. Only if you want to transfer to new accounts do the harder security measures kick in.

It is insecure. Even a Pentium 4 can crack it and my laptop's APU can probably crack it in a few minutes (using OpenCL on the GPU)

"On the other hand, I trust my bank to know what they are doing." I worked for banks in the past: don't trust them.

Note on rate-limiting: You can always use the Tor network to bypass it.

ING Direct and several other banks got breached by drumroll please CSRF attacks! Never trust a bank for security.

My bank recently changed the log-on process to a password and PIN (used to be a card reader generating a code). But when logged in at this level, all I can do is view balances and make payments to already-registered payees. Not too much harm can be done.

@dyesdyes: "And also, because it's 6 digits long, most users are going to use their date of birth or the date of birth of a close relative" Maybe the latter. If the bank accepts the former (or the birthdate of any holder on a shared account), then it's just not fit for purpose.