4 ms·
...then I called my bank, they asked me what was my grand mother's name and I answered "Oh it's a very long, random string". I don't remember how secure the oth
by tajen 10y ago
...then I called my bank, they asked me what was my grand mother's name and I answered "Oh it's a very long, random string". I don't remember how secure the other questions were, but she seemed satisfied with such an answer (and granted me access).
- mpolichette 10y agoDid this really happen? I mean, you know what they say about the weakest link...
- mikeash 10y agoIn my case, I forgot I had a randomly generated answer, gave them the real answer, and the representative got very confused when he tried to compare that to what he had in the system.
- eridius 10y agoIs this a hypothetical or something that actually happened? Because if it's the latter then the rep that you talked to needs to be retrained, because that's equivalent to saying "oh it's some street in San Francisco" when asked what street you grew up on. In any case, I have 1Password generate pronounceable passwords specifically to avoid the problem of the rep trying to compare random alphanumeric strings. 1Password can even generate random phrases of N words (e.g. xkcd passwords) which works well for this sort of thing because it's easy to say those over a phone.
- tajen 10y agoIt did really happen, but as I said I don't remember whether the other questions were tougher. Perhaps they allow one question to be unknown. For example, when you recover a Google account, they ask you when you've created it and the subject of your last email. among other questions. I'm pretty sure I had these ones wrong but they were apparently satisfied with my other answers.
- eridius 10y agoAh, yeah if they ask multiple questions then it would be reasonable for them to allow one wrong answer.
- s_kilk 10y ago> Because if it's the latter then the rep that you talked to needs to be retrained. This is kinda the point though. We can cook up the most elaborate security scheme in the world, but ultimately the keys to our accounts lie with under trained, minimum-wage call center employees. (EDIT: and hey, I've done some grinding minimum-wage bullshit jobs, I completely understand)
- mynameislegion 10y agoUsing diceware strings as the secret questions/answers is good because they are then readable and pronounceable over the phone if you ever actually have to use them.
- girvo 10y agoThats what banks here in Australia do; instead of needing everything right, they ask half a dozen questions which most need to be correct. Which is insecure, if you ask me, but the importantly weighted questions are things like "whats your account balance on <account> here?" and "what account types do you have?" which aren't public info, I guess?