---

New Special Protection — money-lock i.e. disable remote access. Hackers can’t impersonate you physically at a branch.

See also

• https://btv-open.dreamhosters.com/64579/passwd-site-traits/

widespread myth —  even if you are 100% with passwords, devices,,, hackers can still break into your bank accounts.
.. reality — SPF has no confirmed case of money lost to brute-force remote hacking.
However, many of us do use free wifi, and download various software, so we aren’t 100% careful.

— Brute-force remote hacking .. by definition requires numerous repetitions of trial-n-error attempts.

Scenario 1: Suppose your password is weak in a financial_account without 2FA. A remote hacker is simply unable to impersonate you by trial-n-error, because  every remote authentication system has a “kill counter” to detect log-in “retries” and lock down.

Scenario 3a: Suppose you save your FULL password in an encrypted file, and it is leaked. A remote hacker can indeed pay for a powerful compute farm (no trailing “r”) to crack file encryption. Once she gets your password, she can log in to your many financial_accounts without trial-n-error.

Tip: in your personal backup files, never save your entire password as is … better use hints. This way, a brute-force hacker can only see hints and need to try many times and get into Senario 1.

Scenario 3b: suppose your password transmission is encrypted but leaked due to eavesdropping… same result as 3a, but this is a widespread risk affecting millions of remote authentications every day. I trust financial institutions in their technical assessment and their encryption technology.

Tip: avoid using the same password across financial_accounts unless protected by 2FA

Tip: Periodically update passwords en-masse for ALL non-trivial financial_accounts. Usually up to 9 such sites. 

— Q1: If brute-force remote hacking is so easy, then what (confirmed) case count would be a reasonable number?
A: Imagine a naive authentication scheme that converts every credential into a short “password” like a single byte. It’s like a cheap key that can open 10% of the lockers in an entire school. Chance break-in would be frequent. That’s a first scenario.

A: For a second , more sophisticated, scenario, suppose computing power improves enough to let any serious student easily crack 2FA by brute force, then banks would shut down all remote access, and require clients to always visit branches. Remote authentication would be phased out across all industries.

Remote authentication was accepted progressively across industries as system security strengthened demonstrably. When this trend reverses, each enterprise would have to find ways and retreat to earlier, /usable/ systems. Such “retreats” are not so rare — when air travel was considered unsafe during covid pandemic, the industry closed down.

A: for another, more realistic, scenario, suppose in a poor country, a bank physical vault is also easy to hack, then people would just put money under their pillow, rather than saving in the bank. However, under-the-pillow is also easy to hack in this poor country. So private posession would be impractical. We would  return to a world without walls or fences, doors or windows.

A: Look at corporate bank accounts. They have many millions in balance and they are accessible through inet banking. If brute-force remote hacking is so easy, then these corporations would disable remote access.

— Q1b (related question): If car/bicycle locks are so easy to hack by anyone learning from youtube, then what (confirmed) case count is a reasonable number?
A: I would say half the cars would be hacked every year. I think brute-force car hacking is harder than that.

My conclusion as of 2024 — Admittedly, a determined brute-force hacker can use advanced technology to break into any layman’s account but it is not worth hacker’s effort. You CAN protect your money. Your good habits will deter remote hackers, and make their attempts unprofitable.

— bccy
How about crypto wallets and crypto trading accounts. If asset is stolen, law enforcements would offer limited assistance. However, most crypto trading accounts appear relatively safe.

Cold wallet is safer, somewhat comparable to money-lock. Vlad.T said bulk of the assets would be in cold wallet.

I perceive a big advantage of fiat currency account — fund transfer is usually traceable. Bank account or trading account opening process follows regulated, audited procedure. Recipient identity is usually known esp. for large transfers.

==== vulnerabilities
— cpf after 55 ..
— citi.NA