4 ms·

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also,

by bambax 10y ago

Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to reset my password and so-called "security questions". In my experience, there are only two kinds of security questions: ones I don't know the answer to myself, and ones everyone around me knows the answer to (what was your first job, what was your surname when you were a child, etc.) The problem is, in the case of the iPad, your enemy is not some James Bond villain in a cave in Ukraine, it's your 13 year old child who wants to use your account to buy apps, or your spouse during a nasty separation. And they both know, or can guess, answers to "security questions". What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it.

Raphmedia 10y ago
I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"
- GrinningFool 10y ago
  Annoyingly,some sites have started putting limits and validations on their security question answers...
  - tromp 10y ago
    Imagine the site complaining that your answer has "too much entropy" to be correct...
  - syntheticnature 10y ago
    Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy. Oh, and they referred to these security questions as "2FA."
    - zeveb 10y ago
      And what if you never had a pet? I love the ones that ask about one's favourite sports team (not everyone likes sports), or first girl (or boy) friend (not everyone has dated) or first car (not everyone has ever owned a car).
      - Raphmedia 10y ago
        I hated those questions as a kid because I had nothing to answer them with.
    - gry 10y ago
      I ran across something similar on United. https://www.united.com/ual/en/us/account/enroll/default https://www.united.com/ual/en/us/account/enroll/default Derp.
- GrinningFool 10y ago
  Annoyingly,some sites have started putting limits and validations on their security question answers...
- ryandrake 10y ago
  This is a good idea. Unfortunately if you have ever in the past (foolishly) answered these security questions honestly, you can't just now start answering them with your password, unless you keep track of which sites have your honest answers and which sites you just gave your password again.
  - delecti 10y ago
    That's a problem even if you answer honestly all the time. Does this website think my best friend's name is (example) Jake or Jacob? My solution is just to keep those answers in the "extra notes" section of my password manager.
    - Raphmedia 10y ago
      Did I answer "Ste-Citée" or "Ste-Citee" or "Sainte Citée" or "Sainte-Citee" or ... oh, too late, only had two chances to answer. My account is now locked.
  - wubbfindel 10y ago
    Don't use your password. Generate random passwords for each security question and record them in your password manager. So-called "security questions" are the dumbest security measure.
  - Macha 10y ago
    I would put a _different_ password rather than the same password. Lots of site store security question answers in plain text for csrs to verify etc.
pbhjpbhj 10y ago
>What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it. // It weakens it to the extent of your physical security. But in practice how many crackers are breaking in to your flat [aka condo] to find your written down security responses, unless you're famous - or a target some other way (politician?) - in which case you should have sufficient physical security to protect the written answers. Having security questions allows users to use hard passwords without the problem of losing an account. It increases the risk of personal attacks, for sure, but I'd warrant the chance of personal attack [ie by someone who knows you (or has gone through your bins)] is minimal for most people vs. the chance of an automated online attack. I think it's right to minimise the online attack surface at the risk of the offline one for most users.
- bambax 10y ago
  If you're famous, answers to security questions can usually be found in the Wikipedia page about you, so you pretty much have to make them up.
ouid 10y ago
I have never come across an authentication mechanism that actually required your security questions. There's always another route to restoring your password, which means that they do not serve a security function, but rather serve a convenience function, at the expense of security. If you are willing to be brave about this then the best way of answering security questions is by typing a random string and NOT writing it down. You will never need that value again.
- mjevans 10y ago
  I once did that for a site which I didn't want anyone to recover my password to and thus break the security. I -DID- write down the actual password. Today, years later, I still can't login to the damn payroll site because there isn't a procedure for just completely resetting the password state of the account and it wouldn't let you log in without those extra things. Since that point I have recorded every annoying split-password (that's what the 'security questions' actually are, a forced split in the single real password)...
dheera 10y ago
It's also insecure to have password rules because people end up writing, printing, saving passwords in Google Docs, because they can't remember them anymore with those stupid rules. Totally agree about the "security questions". They're just insecurity questions. Everyone knows what street I used to live on and what my previous phone numbers were.
smartbit 10y ago
For security answers I let my password manager generate a Multi Word Phrase you can easily spell out in a phone conversation. Store those in my password manager under my account. Someone told me he had to go through a converstation with Apple Support spelling out 3 random 20+ characater passwords and it was a nightmare. I immediatly switched tactic. Regretfully Apple has an annoying bug that the dialogboxes accepts 5-word phrases, but only remember the first 32characters, 3 words or something alike. Very stressfull when you’re trying to recover a password.

by bambax 10y ago

Raphmedia 10y ago

I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"

GrinningFool 10y ago
Annoyingly,some sites have started putting limits and validations on their security question answers...
- tromp 10y ago
  Imagine the site complaining that your answer has "too much entropy" to be correct...
- syntheticnature 10y ago
  Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy. Oh, and they referred to these security questions as "2FA."
  - zeveb 10y ago
    And what if you never had a pet? I love the ones that ask about one's favourite sports team (not everyone likes sports), or first girl (or boy) friend (not everyone has dated) or first car (not everyone has ever owned a car).
    - Raphmedia 10y ago
      I hated those questions as a kid because I had nothing to answer them with.
  - gry 10y ago
    I ran across something similar on United. https://www.united.com/ual/en/us/account/enroll/default https://www.united.com/ual/en/us/account/enroll/default Derp.
GrinningFool 10y ago
Annoyingly,some sites have started putting limits and validations on their security question answers...
ryandrake 10y ago
This is a good idea. Unfortunately if you have ever in the past (foolishly) answered these security questions honestly, you can't just now start answering them with your password, unless you keep track of which sites have your honest answers and which sites you just gave your password again.
- delecti 10y ago
  That's a problem even if you answer honestly all the time. Does this website think my best friend's name is (example) Jake or Jacob? My solution is just to keep those answers in the "extra notes" section of my password manager.
  - Raphmedia 10y ago
    Did I answer "Ste-Citée" or "Ste-Citee" or "Sainte Citée" or "Sainte-Citee" or ... oh, too late, only had two chances to answer. My account is now locked.
- wubbfindel 10y ago
  Don't use your password. Generate random passwords for each security question and record them in your password manager. So-called "security questions" are the dumbest security measure.
- Macha 10y ago
  I would put a _different_ password rather than the same password. Lots of site store security question answers in plain text for csrs to verify etc.

pbhjpbhj 10y ago

>What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it. // It weakens it to the extent of your physical security. But in practice how many crackers are breaking in to your flat [aka condo] to find your written down security responses, unless you're famous - or a target some other way (politician?) - in which case you should have sufficient physical security to protect the written answers. Having security questions allows users to use hard passwords without the problem of losing an account. It increases the risk of personal attacks, for sure, but I'd warrant the chance of personal attack [ie by someone who knows you (or has gone through your bins)] is minimal for most people vs. the chance of an automated online attack. I think it's right to minimise the online attack surface at the risk of the offline one for most users.

bambax 10y ago
If you're famous, answers to security questions can usually be found in the Wikipedia page about you, so you pretty much have to make them up.

ouid 10y ago

I have never come across an authentication mechanism that actually required your security questions. There's always another route to restoring your password, which means that they do not serve a security function, but rather serve a convenience function, at the expense of security. If you are willing to be brave about this then the best way of answering security questions is by typing a random string and NOT writing it down. You will never need that value again.

mjevans 10y ago
I once did that for a site which I didn't want anyone to recover my password to and thus break the security. I -DID- write down the actual password. Today, years later, I still can't login to the damn payroll site because there isn't a procedure for just completely resetting the password state of the account and it wouldn't let you log in without those extra things. Since that point I have recorded every annoying split-password (that's what the 'security questions' actually are, a forced split in the single real password)...

dheera 10y ago

It's also insecure to have password rules because people end up writing, printing, saving passwords in Google Docs, because they can't remember them anymore with those stupid rules. Totally agree about the "security questions". They're just insecurity questions. Everyone knows what street I used to live on and what my previous phone numbers were.

smartbit 10y ago

For security answers I let my password manager generate a Multi Word Phrase you can easily spell out in a phone conversation. Store those in my password manager under my account. Someone told me he had to go through a converstation with Apple Support spelling out 3 random 20+ characater passwords and it was a nightmare. I immediatly switched tactic. Regretfully Apple has an annoying bug that the dialogboxes accepts 5-word phrases, but only remember the first 32characters, 3 words or something alike. Very stressfull when you’re trying to recover a password.