5 ms·
This data is being circulated for a while now. This makes me so angry. It is good that you show the infrastructure is bad, but how stupid does one have to be t
by mathetic 11y ago
This data is being circulated for a while now.
This makes me so angry. It is good that you show the infrastructure is bad, but how stupid does one have to be to say "do something about Erdogan" to the people who are facing identity theft directly due to one's actions?
Many companies use date of birth and address for authentication. The only thing that is missing is mother's maiden name, which then would be enough to access confidential information at most banks (though they wouldn't be able to transfer money without authorisation code).
- xorcist 11y agoLet's hope that leaks like this forces the banks you speak of to care more about authentication.
- eveningcoffee 11y agoMany companies use date of birth and address for authentication. The only thing that is missing is mother's maiden name, which then would be enough to access confidential information at most banks (though they wouldn't be able to transfer money without authorisation code). Maybe they should learn a lesson from here - information that you do not control should not be used for authentication. Especially the one that is in its essence public.
- MatekCopatek 11y agoExactly! This is about as secure as having your first dog's name as a password reset hint. I either already know or can simply ask about the birthday, address and mother's maiden name of practically anyone I know.
- sbarre 11y agoI've always hated the mother's maiden name security question because my mother kept her maiden name so it's not exactly a hard thing to figure out in my case. I think that one will go away sooner than later though, because taking a husband's name is becoming less common in a lot of societies.
- fvargas 11y agoPro tip: You shouldn't be answering those questions truthfully.
- vinchuco 11y agoBut you have to remember the answers correctly. How do you keep track ?
- hobs 11y agoI usually store it as another password field in keepass http://keepass.info/ http://keepass.info/
- fvargas 11y agoThe lazy way (which is still arguably better than answering truthfully) is to use the same answer for all the security questions. The better way is to treat each answer as another password and encrypt and store the answers somewhere safe.
- thirdsun 11y agoRealistically how many people outside (or even inside) HN are going to do that? No matter how you spin it, security questions are a very bad "security pattern" in my opinion and we should get rid of them.
- 11y ago
- deleted 11y ago[deleted]
- madaxe_again 11y agoEasiest things on the planet to mine, too - the below lark appears to still work, from its ongoing prevalence. "Your superhero name is your first pet's name, your mother's maiden name, and the street you grew up on - mine is Muffy Hitler Queen, what's yours?"
- StavrosK 11y agoI just tell them my dog's name was Beez6Ich8eeso5uil6Pha4omailai2fu and store it in my Dropbox-stored KeePass database.
- julianwachholz 11y agoWell we just used to call him old Bee..
- nroets 11y agoThank you for answering the security question Mr. Stavros. I'll accept "Bee" as your dog's name. To which offshore bank did you say you wanted to transfer the money ?
- thfuran 11y agoRecently United Airlines changed their online security policy and added security questions. The answers to which must be chosen from dropdowns.
- jlebrech 11y agoI always mash the keyboard for those
- deleted 11y ago[deleted]
- dexterdog 11y agoUnfortunately when people can control it they lose it.
- nucleardog 11y agoNot just public information, but unchangeable information. If the information is "compromised" by being looked up in a publicly available database, what are you going to do? Change your birthday?
- gkya 11y agoDo you know whether Turkish state authorities are aware of this thing?
- yilugurlu 11y agoThey seem aware, they just blocked the page that we can not access without Vpn.
- driverdan 11y ago> Many companies use date of birth and address for authentication. Who does? I've seen them used as part of the signup process for some services but never as standalone authentication.
- Kudos 11y agoIf you add in a phone number, almost every company I interact with in Ireland.
- pmorici 11y agoHow to companies verify mother's maiden name? I've never used my mothers real maiden name when filling out any kind of account application form and no one has ever batted an eye.
- ssh42 11y ago> The only thing that is missing is mother's maiden name. It's extremely unsafe for known distribution of last names. E.g. in leaked db most frequent 12 last names correspond to 10% share of population, and most frequent 50 names "explain" 20% of population.