5 ms·

> Knowledge-based authentication (KBA) is out. All the rules are great, but this one might be my favorite. Every time I faced a list of KBAs I felt like I was

> Knowledge-based authentication (KBA) is out. All the rules are great, but this one might be my favorite. Every time I faced a list of KBAs I felt like I was trapped in UCB's comedy sketch: https://www.youtube.com/watch?v=tMEjpXJZgIA https://www.youtube.com/watch?v=tMEjpXJZgIA (If a common security device is bad enough for a comedy troupe to have a bit on it, maybe it could use some work.) The worst KBAs I've seen are for United's frequent flyer program. Almost every question is of the form "What is your favorite X?" X includes items like "vegetable" or "summer sport." Maybe most people have strong opinions about the superiority of broccoli and tubing, but I was always just scratching my head. (The questions were mandatory and you could not write your own.)

Freak_NL 10y ago
Yes, my mother's maiden name is Een3oquu+P_a9oez0queiPhaeChaijoh, why do you ask? Ironically, you usually can enter a string as answer to those questions that is more secure than the allowed password.
- brownbat 10y ago
  You'd think. United gives you a drop down with around ten common answers to choose from. If you happen to have a favorite vegetable, but it's, say, the daikon, you're out of luck.
- TorKlingberg 10y ago
  And then you call phone support and they ask you for it.
  - chris_wot 10y ago
    Amazing how we don't allow support to know the password, but the security question answers that allow access - that' fine! If I had to break in to an account, I'd choose one that used recovery questions. That'S far easier than cracking a password.
  - pluma 10y ago
    "I just entered a string of random characters." "That is correct. Thank you."
    - jandrese 10y ago
      mentally: "I knew he was the kind of guy who would do that." "Go ahead and transfer all of the billing information to this address and change the email to evilhacker@guy.com. Thanks." CSR: "Sure, I'm happy to be of help."
  - a-priori 10y ago
    I actually had this happen once. The conversation went something like this: Them: "I need to ask you a few security questions. What's your mother's, uh... mother's maiden name?" Me: "Oh yes, I put a bunch of random letters and numbers there, let me pull that up for you... A Q 1 #..." T: "... That's okay thanks. Next question: what street did you grow up on?" M: "Same deal there?" T: "Yeah, we're done." I got the feeling the support agent had never seen someone do this before and thought I was crazy.

Freak_NL 10y ago

Yes, my mother's maiden name is Een3oquu+P_a9oez0queiPhaeChaijoh, why do you ask? Ironically, you usually can enter a string as answer to those questions that is more secure than the allowed password.

brownbat 10y ago
You'd think. United gives you a drop down with around ten common answers to choose from. If you happen to have a favorite vegetable, but it's, say, the daikon, you're out of luck.
TorKlingberg 10y ago
And then you call phone support and they ask you for it.
- chris_wot 10y ago
  Amazing how we don't allow support to know the password, but the security question answers that allow access - that' fine! If I had to break in to an account, I'd choose one that used recovery questions. That'S far easier than cracking a password.
- pluma 10y ago
  "I just entered a string of random characters." "That is correct. Thank you."
  - jandrese 10y ago
    mentally: "I knew he was the kind of guy who would do that." "Go ahead and transfer all of the billing information to this address and change the email to evilhacker@guy.com. Thanks." CSR: "Sure, I'm happy to be of help."
- a-priori 10y ago
  I actually had this happen once. The conversation went something like this: Them: "I need to ask you a few security questions. What's your mother's, uh... mother's maiden name?" Me: "Oh yes, I put a bunch of random letters and numbers there, let me pull that up for you... A Q 1 #..." T: "... That's okay thanks. Next question: what street did you grow up on?" M: "Same deal there?" T: "Yeah, we're done." I got the feeling the support agent had never seen someone do this before and thought I was crazy.