if username and password are insufficient for authentication

Question

if my username and password are insufficient for authentication and yet clicking on a girafe does authenticate me, what is ebay doing in business? They should be shut down

eburtonlab · Answer

Clicking on a giraffe does not prove you are you; it proves you are not a bot trying passwords at random. That is why you still need to supply a username and password, along with selecting all the giraffes or checking a box or identifying a number.

Absent any sort of bot screen, a very simple script could test the top ten thousand or so most common passwords against a set of usernames and quickly gain access to some of those eBay accounts.

Testing passwords by hand plus identifying giraffes would take a bit more effort and time, and most hackers will not bother trying that.