4 ms·

Haven't we moved on from pretending SSNs are secret or useful in any way? Now there's two factor authentication ("what's your favorite color?"), etc. When I re

Haven't we moved on from pretending SSNs are secret or useful in any way? Now there's two factor authentication ("what's your favorite color?"), etc. When I read that The Hackers have my SSN again I'm not really that worried having lost count. But if we had a Federally issued Secure ID, when (not if) that got hacked I would worry a lot.

JadeNB 10y ago
> Now there's two factor authentication ("what's your favorite color?") Not so great an example of secret information …. TFA is useless, I think, unless you are allowed to pick the question. (Or, of course, you can give site-specific nonsense answers to repeated questions, but most people don't do that.)
- WorldMaker 10y ago
  "Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". The two factors are supposed to be: something only you know (a password) and something only you have (a physical key or device you keep with you). Secret questions are still just something you know, therefore not a second factor from passwords. Secret questions are often worse than two factor because they also violate the "only you" part of the security factors by often asking mostly the equivalents of public record information making them generally only about as useful as tertiary usernames/IDs. (Which is why the advice these days is to treat them as passwords and give them pseudo-randomized phrases, unconnected to actual answers of the stated question.)
  - JadeNB 10y ago
    > "Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". You are right. I was going along with what I perceived as my parent (https://news.ycombinator.com/item?id=12509768 https://news.ycombinator.com/item?id=12509768 )'s identification of 'secret' questions with TFA, but I shouldn't have. Thank you for the correction. (Also, although surely there aren't many such people around here, for anyone who doesn't get your reference: http://thedailywtf.com/articles/WishItWas-TwoFactor- http://thedailywtf.com/articles/WishItWas-TwoFactor- .)

JadeNB 10y ago

> Now there's two factor authentication ("what's your favorite color?") Not so great an example of secret information …. TFA is useless, I think, unless you are allowed to pick the question. (Or, of course, you can give site-specific nonsense answers to repeated questions, but most people don't do that.)

WorldMaker 10y ago
"Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". The two factors are supposed to be: something only you know (a password) and something only you have (a physical key or device you keep with you). Secret questions are still just something you know, therefore not a second factor from passwords. Secret questions are often worse than two factor because they also violate the "only you" part of the security factors by often asking mostly the equivalents of public record information making them generally only about as useful as tertiary usernames/IDs. (Which is why the advice these days is to treat them as passwords and give them pseudo-randomized phrases, unconnected to actual answers of the stated question.)
- JadeNB 10y ago
  > "Secret questions" are almost always not two factor, they are "Wish It Was Two Factor". You are right. I was going along with what I perceived as my parent (https://news.ycombinator.com/item?id=12509768 https://news.ycombinator.com/item?id=12509768 )'s identification of 'secret' questions with TFA, but I shouldn't have. Thank you for the correction. (Also, although surely there aren't many such people around here, for anyone who doesn't get your reference: http://thedailywtf.com/articles/WishItWas-TwoFactor- http://thedailywtf.com/articles/WishItWas-TwoFactor- .)