10 ms·

It's nearly impossible to remember what you answered for those questions anyway. For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc? I don't

It's nearly impossible to remember what you answered for those questions anyway. For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc? I don't have a specific favorite movie or song. Lord knows what I entered into one of those boxes a year or two ago. Whatever it was, I bet it wasn't as secure as my password.

thinkfurther 9y ago
> For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc? No biggie, the person telling you at length about the quirks of their first car until you mention what your first car was will happily try them all.
- rockostrich 9y ago
  One of the questions my bank asks is what middle school I went to and I used my elementary school by mistake. I just listed every school I went to to the guy on the phone when trying to unlock my account. It's a good thing they also ask for SSN/amount previously in the account/who your last check was made out to and that sort of thing.
  - deleted 9y ago
    [deleted]
  - distances 9y ago
    A secret question asked by a bank would be a strong hint for me to take my money elsewhere. They definitely should be using one-time keys from a paper slip or some similar third factor.
    - keevie 9y ago
      That's a nice idea, but at least every us bank I've seen does this, so...
      - distances 9y ago
        That's definitely a bit tougher then. I have experience only with European banks that don't do the security question theater.
    - 0xffff2 9y ago
      Does any bank (or anyone, actually) really do this though? It's easy to say you should take your money elsewhere, but where would you actually take it?
      - tim333 9y ago
        Santander International do for a start.
      - distances 9y ago
        Answered the sibling already, but I have experience only with European banks where I don't see this happening. I have account in two banks, both of which provided a paper slip with one-time authorization codes.
      - dfox 9y ago
        One european bank I have account at uses security question, but it seems to be only used as additional layer of authentication when you make changes to your account settings (in person) and not for anything online.
      - tscs37 9y ago
        My bank goes a step farther and requires me to physically show up in their branch office and verify my ID. It has to be the branch near my residence. It's not a bother since it's a 5 minute walk but I imagine that it would be hard for anyone other than me to actually do this, they'd have to show up there and convince the people there they are actually me (and some of these people now me personally) I'd say that this would be the optimum in security.
      - noinsight 9y ago
        In Finland they all do. Before mobile apps, they mailed you cards with one time passwords in them, every time you logged in you had to provide your account number and OTP. Also, every time you confirmed a payment, you had to use a random security code from said card. These days they provide apps for phones where when you make a payment you have to open the bank app and enter your PIN to confirm the payment. Same for logging in to online banking (for which there are mobile apps as well). Also, when making a debit/credit card payment online, you also have to confirm it with one of the aforementioned methods. You can't do anything with just the card details. I can't believe some banks around the world use plain old passwords only...
  - dhimes 9y ago
    I'm of the opinion that the answer to those questions should have nothing to do with the question. Make of first car? Equilateral. EDIT: like this https://news.ycombinator.com/item?id=14856834 https://news.ycombinator.com/item?id=14856834
wst_ 9y ago
When they ask you for a first car you should answer, for example, "yellow" or "miskatonic university". When they ask for favorite music band you answer "ford". Choose random words or even random strings. Nothing related to the question itself. Just write them down. Most password managers allow you to add a notes. Of course only when you can't avoid "secret" questions... At least no one will be able to profile you and guess the answers.
WorldMaker 9y ago
I started to store them in my password manager for that very reason that months later I'd never remember exactly what I put down. Then the next point is realizing since they are "bonus passwords" anyway you might as well randomize them and use password fields. (In the Advanced Fields properties of an entry in KeePass, for instance, you have a key-value store and when you add one the "Protect in Memory" treats the value the same as KeePass treats other passwords.) The final realization was that these questions should probably be labeled "Phone Passwords" and in which case use something like Diceware that produces easily pronounceable over the phone passwords.
bluGill 9y ago
Lets see, when I answered this question was I listening to heavy metal, classical, country, or... I happen to enjoy all of the above at times despite them being vastly different they are all music (or can be - I have heard examples from all 3 that are not)

thinkfurther 9y ago

> For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc? No biggie, the person telling you at length about the quirks of their first car until you mention what your first car was will happily try them all.

rockostrich 9y ago
One of the questions my bank asks is what middle school I went to and I used my elementary school by mistake. I just listed every school I went to to the guy on the phone when trying to unlock my account. It's a good thing they also ask for SSN/amount previously in the account/who your last check was made out to and that sort of thing.
- deleted 9y ago
  [deleted]
- distances 9y ago
  A secret question asked by a bank would be a strong hint for me to take my money elsewhere. They definitely should be using one-time keys from a paper slip or some similar third factor.
  - keevie 9y ago
    That's a nice idea, but at least every us bank I've seen does this, so...
    - distances 9y ago
      That's definitely a bit tougher then. I have experience only with European banks that don't do the security question theater.
  - 0xffff2 9y ago
    Does any bank (or anyone, actually) really do this though? It's easy to say you should take your money elsewhere, but where would you actually take it?
    - tim333 9y ago
      Santander International do for a start.
    - distances 9y ago
      Answered the sibling already, but I have experience only with European banks where I don't see this happening. I have account in two banks, both of which provided a paper slip with one-time authorization codes.
    - dfox 9y ago
      One european bank I have account at uses security question, but it seems to be only used as additional layer of authentication when you make changes to your account settings (in person) and not for anything online.
    - tscs37 9y ago
      My bank goes a step farther and requires me to physically show up in their branch office and verify my ID. It has to be the branch near my residence. It's not a bother since it's a 5 minute walk but I imagine that it would be hard for anyone other than me to actually do this, they'd have to show up there and convince the people there they are actually me (and some of these people now me personally) I'd say that this would be the optimum in security.
    - noinsight 9y ago
      In Finland they all do. Before mobile apps, they mailed you cards with one time passwords in them, every time you logged in you had to provide your account number and OTP. Also, every time you confirmed a payment, you had to use a random security code from said card. These days they provide apps for phones where when you make a payment you have to open the bank app and enter your PIN to confirm the payment. Same for logging in to online banking (for which there are mobile apps as well). Also, when making a debit/credit card payment online, you also have to confirm it with one of the aforementioned methods. You can't do anything with just the card details. I can't believe some banks around the world use plain old passwords only...
- dhimes 9y ago
  I'm of the opinion that the answer to those questions should have nothing to do with the question. Make of first car? Equilateral. EDIT: like this https://news.ycombinator.com/item?id=14856834 https://news.ycombinator.com/item?id=14856834

wst_ 9y ago

When they ask you for a first car you should answer, for example, "yellow" or "miskatonic university". When they ask for favorite music band you answer "ford". Choose random words or even random strings. Nothing related to the question itself. Just write them down. Most password managers allow you to add a notes. Of course only when you can't avoid "secret" questions... At least no one will be able to profile you and guess the answers.

WorldMaker 9y ago

I started to store them in my password manager for that very reason that months later I'd never remember exactly what I put down. Then the next point is realizing since they are "bonus passwords" anyway you might as well randomize them and use password fields. (In the Advanced Fields properties of an entry in KeePass, for instance, you have a key-value store and when you add one the "Protect in Memory" treats the value the same as KeePass treats other passwords.) The final realization was that these questions should probably be labeled "Phone Passwords" and in which case use something like Diceware that produces easily pronounceable over the phone passwords.

bluGill 9y ago

Lets see, when I answered this question was I listening to heavy metal, classical, country, or... I happen to enjoy all of the above at times despite them being vastly different they are all music (or can be - I have heard examples from all 3 that are not)