3 ms·

I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total str

by Merad 10y ago

I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total strangers.

tim333 10y ago
I think if I had a casual conversation and they started asking what was your pets name, where did you go to school etc I'd think it a bit odd. As an aside I usually have to write down the answers I've given in a word doc and look them up if I need to do that stuff as I can't remember which memorable place it was and the like.
- mattkrause 10y ago
  Really? I'm sure it would seem odd if someone just ran down the list of questions, but I suspect you could easily maneuver the conversation so that a casual acquaintance answers one or two of them. "Hey, how are you?" "Pretty good. We're thinking about getting a dog so I went to the shelter this morning." "Oh really?" "It's tough to find one that's a good match though." "Definitely" "You ever have a dog?" "Nah, wife's allergic. Had a snake as a kid though...called him Mr. Slithers."
  - ryan-c 10y ago
    You could build a chat bot that does that.
bbotond 10y ago
Man I hate those security questions with a passion. They are super weakly protected backdoors into your account. Here's how I deal with sites that require them: site: "What is your first teacher's name?" me: "'Fx|<n8K@W8#[_,[ (1p)jqPC" The answer is a password equivalent, so I just treat it like a password.
- Tepix 10y ago
  Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!
  - bbotond 10y ago
    That's just appalling.
  - dtemp 10y ago
    Yep. I believe when I created my account, I picked ones that were definitely not real answers, ie. "What's your favorite sport?" answer "lawn darts".
    - bbotond 10y ago
      Even if you picked a fake answer, that doesn't stop someone from brute-forcing it, which is made very easy by the limited range of possible options.
    - majewsky 10y ago
      Any social engineers reading this? :)
  - sshanky 10y ago
    Just give the wrong answer and keep track in your password tracker. At least social engineers can't figure that out.
  - simbalion 10y ago
    Contact their tech group and then contact their CEO and show them this article. :)
- Vexs 10y ago
  Someone pointed out that if you talk to a CS rep and try to say that off, they'd just hear gibberish- meaning if someone tried to get at your stuff, they would just have to spout off gibberish and the CS rep would probably accept it.
in_cahoots 10y ago
To me, the scarier idea is how many of these answers are now online. Mother's maiden name and other family names can be gotten from wedding notices or obituaries. For a teenager, the first job / school / car / concert are probably all available on Facebook. Even without the Internet as a backup, I could probably answer the security questions for 2-4 of my childhood friends.

by Merad 10y ago

I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total strangers.

tim333 10y ago

I think if I had a casual conversation and they started asking what was your pets name, where did you go to school etc I'd think it a bit odd. As an aside I usually have to write down the answers I've given in a word doc and look them up if I need to do that stuff as I can't remember which memorable place it was and the like.

mattkrause 10y ago
Really? I'm sure it would seem odd if someone just ran down the list of questions, but I suspect you could easily maneuver the conversation so that a casual acquaintance answers one or two of them. "Hey, how are you?" "Pretty good. We're thinking about getting a dog so I went to the shelter this morning." "Oh really?" "It's tough to find one that's a good match though." "Definitely" "You ever have a dog?" "Nah, wife's allergic. Had a snake as a kid though...called him Mr. Slithers."
- ryan-c 10y ago
  You could build a chat bot that does that.

bbotond 10y ago

Man I hate those security questions with a passion. They are super weakly protected backdoors into your account. Here's how I deal with sites that require them: site: "What is your first teacher's name?" me: "'Fx|<n8K@W8#[_,[ (1p)jqPC" The answer is a password equivalent, so I just treat it like a password.

Tepix 10y ago
Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!
- bbotond 10y ago
  That's just appalling.
- dtemp 10y ago
  Yep. I believe when I created my account, I picked ones that were definitely not real answers, ie. "What's your favorite sport?" answer "lawn darts".
  - bbotond 10y ago
    Even if you picked a fake answer, that doesn't stop someone from brute-forcing it, which is made very easy by the limited range of possible options.
  - majewsky 10y ago
    Any social engineers reading this? :)
- sshanky 10y ago
  Just give the wrong answer and keep track in your password tracker. At least social engineers can't figure that out.
- simbalion 10y ago
  Contact their tech group and then contact their CEO and show them this article. :)
Vexs 10y ago
Someone pointed out that if you talk to a CS rep and try to say that off, they'd just hear gibberish- meaning if someone tried to get at your stuff, they would just have to spout off gibberish and the CS rep would probably accept it.

in_cahoots 10y ago

To me, the scarier idea is how many of these answers are now online. Mother's maiden name and other family names can be gotten from wedding notices or obituaries. For a teenager, the first job / school / car / concert are probably all available on Facebook. Even without the Internet as a backup, I could probably answer the security questions for 2-4 of my childhood friends.