5 ms·

That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions genera

That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions generator" website.

sleepychu 10y ago
Please do.
OJFord 10y ago
Why is that funny or bad? If your grandmother is living and has a single dog, as 'security questions' go that would strike me as being pretty good.
- kwhitefoot 9y ago
  If your grandmother is alive and has one dog and you use that dog's name as the answer you are not terribly secure because this information is easy to obtain. It's only virtue is that it is, supposedly, easier for you to remember.
  - peterjlee 9y ago
    I'd argue this is one of the more secure questions compared to other common questions like "Your mother's maiden name" or "The make of your first car".
    - OJFord 9y ago
      Exactly. I don't know how to go about finding out someone's (not personally known to me) grandmother's dog's name, but if I know someone's name then mother's maiden name is easy in the UK.
- IshKebab 9y ago
  Because the number of people who have a grandmother with a dog that they know the name of is very small.
  - djtriptych 9y ago
    Right. Exactly one grandmother with exactly one living dog and you know its name. I literally can't think of anyone I know who could answer this.
- tudorconstantin 9y ago
  When you want to retrieve the password for an account you created 5 years ago, but you only remember creating it between 5 and 15 years ago and you have 2 dog loving grandma's each of whom have 2-3 old doggos all the time....well, good luck in remembering and identifying the correct name of the possible 10-15 dogs
  - gknoy 9y ago
    This is a case where you think of an _idealized_ grandma, and her perfectly preserved dog, `Mr. Mycroft Applebottom III`, who has been sitting on her mantlepiece since you were in gradeschool. [0] The site doesn't have to know you're making it up. 0: Obviously, it'd be better if your idealized grandma spoke with your password generator beforehand, and therefore named her dog something less guessable, like `ff627f056c51b694e2e5d0bdc168c647`.
    - OJFord 9y ago
      That's a good suggestion actually: just remember that you always ignore the question, and you've saved the actual securely generated answer as 'sitename-sec-question' or whatever.
  - OJFord 9y ago
    Right but if there are six possible dogs at creation time you choose a different question. If the answer is unique when you create it, but a new dog comes into the picture when you need to recall it, I doubt that's going to cause much of a problem. Maybe you get it wrong once and try again - you're only going through this because you already forgot your password.
- mikeash 9y ago
  It's a bad idea to use anything that might change. For example, "What was the make of your first car?" Might be OK. "What is the make of your favorite car?" Not good, odds are decent your favorite will change between setting the answer and trying to use it.
  - OJFord 9y ago
    I'll take that usability problem over the security problem of using my mother's maiden name though.
jfoutz 9y ago
I don't know if it's a good practice or not, but i usually just pick a word to use for all security questions, that's totally unrelated to the question. ex. I what town did you first meet your best friend? "potato".
- amnah 9y ago
  the problem then is when they ask for multiple security questions "potato" "potato" "potato" then they tell you that you cant use the same security answer for multiple questions ...... and thats when i nope out
- BinaryIdiot 9y ago
  This is sorta what I do except I use a unique answer for each one and I store the question and answer in my password manager. Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone.
  - bm5k 9y ago
    Same here.
  - thaumasiotes 9y ago
    > Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone. I filled the security answer for my Blizzard account with random ascii garbage, which I didn't record, confident that I would always know my password. That was true. But Blizzard disabled my account for purchasing time codes with a credit card other than the one that my account designated "preferred payment". (The card I was paying with was also listed under my account, but it wasn't "preferred". I have no idea what attack they think they're defending against.) I had to call in. Phone-based customer service accepted "I don't think I can give you the answer to the security question" as a valid answer. Security!
  - dsacco 9y ago
    I've had to do it a few times, because I do that same thing. They usually respond with exasperation and say something like, "No, sir we need your security answer not your password." Then it's my turn to be exasperated and say, "No, check again, that's the answer." Very fun.
mandeepj 9y ago
Are you guys all serious? Just give it a word which you can remember. They are not going to cross check it.

That "What is the name of your grandmother's dog?" security question made me lol @ work. This really makes me want to write a "Stupid security questions generator" website.

sleepychu 10y ago

Please do.

OJFord 10y ago

Why is that funny or bad? If your grandmother is living and has a single dog, as 'security questions' go that would strike me as being pretty good.

kwhitefoot 9y ago
If your grandmother is alive and has one dog and you use that dog's name as the answer you are not terribly secure because this information is easy to obtain. It's only virtue is that it is, supposedly, easier for you to remember.
- peterjlee 9y ago
  I'd argue this is one of the more secure questions compared to other common questions like "Your mother's maiden name" or "The make of your first car".
  - OJFord 9y ago
    Exactly. I don't know how to go about finding out someone's (not personally known to me) grandmother's dog's name, but if I know someone's name then mother's maiden name is easy in the UK.
IshKebab 9y ago
Because the number of people who have a grandmother with a dog that they know the name of is very small.
- djtriptych 9y ago
  Right. Exactly one grandmother with exactly one living dog and you know its name. I literally can't think of anyone I know who could answer this.
tudorconstantin 9y ago
When you want to retrieve the password for an account you created 5 years ago, but you only remember creating it between 5 and 15 years ago and you have 2 dog loving grandma's each of whom have 2-3 old doggos all the time....well, good luck in remembering and identifying the correct name of the possible 10-15 dogs
- gknoy 9y ago
  This is a case where you think of an _idealized_ grandma, and her perfectly preserved dog, `Mr. Mycroft Applebottom III`, who has been sitting on her mantlepiece since you were in gradeschool. [0] The site doesn't have to know you're making it up. 0: Obviously, it'd be better if your idealized grandma spoke with your password generator beforehand, and therefore named her dog something less guessable, like `ff627f056c51b694e2e5d0bdc168c647`.
  - OJFord 9y ago
    That's a good suggestion actually: just remember that you always ignore the question, and you've saved the actual securely generated answer as 'sitename-sec-question' or whatever.
- OJFord 9y ago
  Right but if there are six possible dogs at creation time you choose a different question. If the answer is unique when you create it, but a new dog comes into the picture when you need to recall it, I doubt that's going to cause much of a problem. Maybe you get it wrong once and try again - you're only going through this because you already forgot your password.
mikeash 9y ago
It's a bad idea to use anything that might change. For example, "What was the make of your first car?" Might be OK. "What is the make of your favorite car?" Not good, odds are decent your favorite will change between setting the answer and trying to use it.
- OJFord 9y ago
  I'll take that usability problem over the security problem of using my mother's maiden name though.

jfoutz 9y ago

I don't know if it's a good practice or not, but i usually just pick a word to use for all security questions, that's totally unrelated to the question. ex. I what town did you first meet your best friend? "potato".

amnah 9y ago
the problem then is when they ask for multiple security questions "potato" "potato" "potato" then they tell you that you cant use the same security answer for multiple questions ...... and thats when i nope out
BinaryIdiot 9y ago
This is sorta what I do except I use a unique answer for each one and I store the question and answer in my password manager. Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone.
- bm5k 9y ago
  Same here.
- thaumasiotes 9y ago
  > Sometimes I use a straight up password generator for the answers. Hope I never have to give those out over the phone. I filled the security answer for my Blizzard account with random ascii garbage, which I didn't record, confident that I would always know my password. That was true. But Blizzard disabled my account for purchasing time codes with a credit card other than the one that my account designated "preferred payment". (The card I was paying with was also listed under my account, but it wasn't "preferred". I have no idea what attack they think they're defending against.) I had to call in. Phone-based customer service accepted "I don't think I can give you the answer to the security question" as a valid answer. Security!
- dsacco 9y ago
  I've had to do it a few times, because I do that same thing. They usually respond with exasperation and say something like, "No, sir we need your security answer not your password." Then it's my turn to be exasperated and say, "No, check again, that's the answer." Very fun.

mandeepj 9y ago

Are you guys all serious? Just give it a word which you can remember. They are not going to cross check it.