5 ms·
Fun with your bank's secret questions & answers
- steveklabnik 17y agoI answer every single security question with a nonsensical answer. CSRs get really confused.
- pmichaud 17y agoThis is really hilarious, and I think it qualifies as system hacking.
- javanix 17y agoIt's also somewhat cruel to whoever has to read your "clever" message.
- branden 17y agoCruel? It might make a callcenter employee smile. It's borderline humanitarian.
- techiferous 17y agoIt passes the Golden Rule test. :)
- nandemo 17y agoIt's so silly, but very funny indeed (see also the comments on Schneier's post). But I guess it's only possible because this particular bank really messed up, isn't it? Custom security questions are meant to be used in netbanking, not to be asked by humans. Are there any other banks who do that?
- viraptor 17y agoAh... I'd really like someone on the other end to say: "You can change your balance yourself, just use my login - the staff password is sexy_stud."
- evo_9 17y agoYeah this is quite clever and funny. Plus Zardoz?!? Wow, nice crazy old movie reference, that's awesome.
- pella 17y agohttp://www.schneier.com/blog/archives/2010/04/fun_with_secret.html http://www.schneier.com/blog/archives/2010/04/fun_with_secre...
- deleted 17y ago[deleted]
- DTrejo 17y agoI like this one: Q: If I said you had a beautiful body, would you hold it against me? A: Sorry, you're not my type.
- deleted 17y ago[deleted]
- chaosmachine 17y agoThis is great. Reminds me of that guy who kept signing his credit card statements with increasingly random signatures. http://news.ycombinator.com/item?id=1311710 http://news.ycombinator.com/item?id=1311710
- dryicerx 17y agoThis is excellent! I wish more systems would let you configure the secret question instead of giving a set of predefined questions... (eg. mother's maiden name, first school, first friend, first town, etc), and most of those questions can be found out about a person with some small talk. For places like that my solution has been to give scrambled answers (eg. city of birth, the answer 'colombo' becomes 'obmoloc'. Also this isn't my scrambling method or answer, just an example).
- tamersalama 17y agoIf this clever answer/question takes off - nobody will provide an open question format.
- sabat 17y agoAnother simple but effective hack: have a standard untrue answer for your mother's maiden name, first school, etc. Only you will know them. Your mother's maiden name is McLuvin.
- IgorPartola 17y agoI usually provide an untrue date of birth to places where it doesn't matter. The only places that really need to know are the places that also need your SSN. Everybody else just likes having sensitive info lying around.
- aberman 17y agoI'm changing my bank to this one immediately.
- stretchwithme 17y agoall my emails from etrade start with: Hey, you big stud!
- jbeda 17y agoA simple "speech injection attack." The bank obviously needs to sanitize the input before serving it up.
- kschua 17y agoWhat happens if Security Question: Can you repeat the question? Answer: Can you repeat the question?