14 ms·
And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated t
by sersi 9y ago
And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question..
My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager
Security questions weakens the security of an account, they are easily found information that people can just guess.
- djsumdog 9y ago"Your mother's maiden name has numbers in it?" (bank teller, DMV person, etc.) "You .. give real answers for your security questions? Seriously?" I do the same thing, real birthday if it's financial or employee related, but for everything else, I'm a few years older on another date. I often pick a security question that I don't have a real legit answer to as well.
- raverbashing 9y agoYes, I try to make the fake answer sound legitimate though City you were born? Just pick any (random/unrelated) city instead of 2DXSDGREDV@#! It's easier if you have to go through a person (which is usually forced to go through a script) also easier on the phone
- jacquesm 9y agoI do this too, some phone number checks and email checks are surprisingly good.
- dredmorbius 9y agoThe search space for city names is tragically finite. There are ~35,000 cities and towns in the U.S., but if you start weighting those by populating (and birthing hospitals and centres), you're going to reduce that count considerably. https://www.reference.com/geography/many-cities-united-states-cfb3be08284e6a62 https://www.reference.com/geography/many-cities-united-state...
- llukas 9y agoWhy pick name of U.S. city or more general city in country you live/are related to? There are a lot of lovely and easy to remember names in other countries ;)
- raverbashing 9y agoYes but if a system allows you to bruteforce this you probably have bigger problems
- dredmorbius 9y agoThe overall risk runs a few different ways. One is that you yourself will bee at risk, another is that there will be a high number of compromises. There are about 300 in the U.S. of over 100k population (corollary: the other 34,700 locations have fewer than 100k people each, or are at most 10% of the population). A 1/300 chance of cracking a security question on any given transaction is pretty good odds. Particularly if the crack is then reusable. Another 10% of the U.S. population (roughly) lives in the 10 largest cities alone. That's a 1% likely success rate based on just ten values. The point being that "legitimate sounding but fabricated" may still not be a particularly good option.
- wila 9y agoNot just easier, but actually more safe. The person on the phone isn't usually aware about your security "paranoia" and is being evaluated on how much customers he/she has been able to help. As such most helpdesk employees will accept the answer "Oh I forgot, I do remember I put some random characters in there"... and your random password end up not helping you after all.
- ubernostrum 9y agoAs noted in another comment, the attack on this of "oh I forgot, it's random characters" requires the attacker to know you do this. So if you do this, don't go disclosing it on public websites.
- whiddershins 9y agoAs another commenter mentioned, a help desk rep once gave the clue "it's really weird" over the phone, which would easily indicate to an attack to try the mash the keyboard line. The random character thing isn't great for this use, it seems, as a result.
- ubernostrum 9y agoIf support reps give enough information away over the phone to let someone guess a security question, there is nothing you can do to protect yourself from them.
- always_good 9y ago>requires the attacker to know you do this Nah, "well, it kinda looks like random characters" is information a support rep will give you. Welcome to social engineering and info escalation.
- ubernostrum 9y agoIf the support rep is just giving away enough info to figure this out, there is nothing you can do to protect yourself against the company's policies.
- drdaeman 9y agoI believe the general recommendation I saw was to type something in lines of "never accept this answer - it's probably someone trying to impersonate me | 2DXSDGREDV@#!" (although it's probably hard to do so if the maximum acceptable length is too short)
- mjlee 9y agoI doubt this would help, it seems fairly unlikely that whoever answers the phone would be interested in playing logic puzzles.
- ubernostrum 9y agoThis is how you get engraved plaques, or birthday cakes, with the message NO MESSAGE JUST LEAVE IT BLANK on them.
- drdaeman 9y agoHaha, true. Still, if that helps in one case per thousand, it's still better than none.
- anthonyeye 9y agoWe offer fast and easy loan to everyone without any stress. Blacklisted are also welcome Hello dear loan seekers, are you a business man or woman, Are you tired of seeking loans or are you in any financial mess,have you been turned down constantly By your banks and other financial institutions,We offer any form of loan to individuals and corporate bodies at low interest rate of 2%. If you are interested in taking a loan,feel free to contact us today,we promise to offer you the best services ever. Just give us a try,because a trial will convince you . What are your Financial needs? Do you need a business loan? Do you need a personal loan? Do you want to buy a car or a house? Do you want to refinance?Do you need a mortgage loan? Do you need a huge capital to start off your business proposal or expansion? Do you need to pay medical bills, Have you lost hope and you think there is no way out, and your financial burdens still persists? Contact us with our valid emails: (anthonysa.agentloan@gmail.com) You can also call us or send message through whatssap : +12679065312 Thanks and look forward to your prompt reply Please email us at: (anthonysa.agentloan@gmail.com) for an application form.
- apcherry 9y agoI don't even try to make it sound legitimate. e.g. How many sisters do you have? Anyone guessing will be trying a number between 0 and 5. I use a semi-random word, colour or car I associate with my sister(s), eg. Audi. When asked for a number no one guessing will respond with a car make.
- bitshepherd 9y agoSomeone has the idea behind challenge/response. You don't have to answer the challenge with a 100% truthful, legitimate, accurate response, because the point is to NOT provide an answer that could be guessed by framing the response in truth, or even reality. So long as you've picked one that matches with what you've preseeded, use a random word/phrase as your response. q: What is the name of your favorite teacher? a: bumble bees in the desert
- cortesoft 9y agoYeah, but the key is you need to be able to remember it. Sure, you could store it somewhere, but often times the reason you are needing to use it is because you don't have access to your normal system (computer, phone) that you use to login with.
- projektir 9y agoI don't recall the last time I used secret answers to get into anything. I don't perceive it as a valid way to get into an account. But the option cannot be refused... so to me it's just a security risk.
- sersi 9y agoI've had to use security answers because I was locked out by systems that detected I was using an ip from a different country and so refused my correct password and were using the security questions as a kind of extra authentication. The amount of stupidity needed to build such a system is staggering.
- mrhappyunhappy 9y agoDoesn't matter if you give your real bday or not. I could easily google you, email one of your coworkers and ask for your birthday for a secret gift. Voila.
- mrhappyunhappy 9y agoIgnore my last comment. I didn't follow your logic of putting a fake birthday into the site haha. Doh!
- Xoros 9y agoThe first time (years ago...) I had to enter my birth date on a website that asked it to me for no valid reason, there was a default value. It's now my birthdate on every others !
- sbarre 9y agoJanuary 1st 1970 is sometimes known as "The Internet's birthday" for this reason..
- userbinator 9y agoIt's also the "UNIX Birthday".
- alanh 9y agoRight, leave it blank when enrolling → Empty value coerced to number becomes 0 → Recorded in Unix timestamp format where 0 is Jan 1 1970 → Wow, everyone was born then?
- cesarb 9y agoI never quite got this "mother's maiden name" thing. Isn't your mother's maiden name... your mother's current name, minus the extra surname she got when she married? Why is this treated as a hard-to-discover information?
- alkhatib 9y agoIn the US and other countries it's common for a wife to take her husband's last name. Changes from "Jane Doe" to "Jane Smith"
- ricardobeat 9y agoI think he's saying the maiden name is easily found. At least in Brazil, the husband's surname is _appended_ at the end, doesn't replace the maiden one: Jane Doe Smith.
- Merad 9y agoYeah, but often (usually?) the woman's maiden name replaces her middle name. E.g. Jane Elizabeth Doe -> Jane Doe Smith. I'm pretty sure my mom's maiden name is printed on her driver's license, paper checks, etc.
- lsaferite 9y agoI know very few women that have done that TBH.
- Merad 9y agoMaybe you just didn't realize it, because it isn't very common to see someone's full name? It was very much the norm until the 80s-90s, and even today I think the majority of women still go that route. I just spent a couple minutes searching Facebook to sanity check myself, and so far all of the women I'm friends with who are under 30 and married have done it.
- 9y ago
- Spivak 9y agoI think the best bet is to provide an actual name in that field, just not the real one. Grab a list of the surnames and pick one at random. Bonus if you hyphenate two.
- JupiterMoon 9y ago> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..
- musage 9y agoBut the attacker kind of has to know the answer is gibberish from the bat, otherwise they'd either guess or pretend to not remember a real answer, which is noticeably different from saying something like "oh, that's 30 random characters but I don't have the note with me right now".
- tonyedgecombe 9y agoBut we already know @sersi just mashes the keyboard for those questions :)
- sersi 9y agoSure, but I doubt it would be easy to find my identity from my hn account name.
- cortesoft 9y agoHere is how it would go... attacker gives a real answer, support says no that isn't it. Attacker goes, "oh, sometimes I give fake answers for the question... is it a really long string of characters?" Or they could go through a few things like that, always giving the excuse that they give false answers until they stumble on the right one.
- Sir_Cmpwn 9y agoYou don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.
- andyjohnson0 9y agoI use my real birth date when dealing with my bank or government departments. Everyone else gets the same fictitious but approximately correct date.
- baby 9y agoWhen I was in high school, SWIM was stealing everybody's MSN's accounts. The technique got out, it was through these "security questions", then SWIM got his MSN stolen. Then people would recreate MSN accounts and get it stolen again. It became a funny war until some dude started asking for money to other people's contacts (via allopass, these things where you could just call a number to get charged and obtain some token). Good times. Except some of my friends actually sent out some money. I'm pretty sure I know who did it. Since then I enter garbage in these security questions. Better lose my account than that.
- alanh 9y agoi had to look it up: SWIM = Someone Who Isn’t Me
- ape4 9y agoMy bank's terms of service bans recording passwords - ie managers.
- zaneyard 9y agoHow are they supposed to know you use one?
- diggan 9y agoNot that they can really know, but most I've seen is that they disable pasting anything into the website, effectively making banking super slow for us with password managers and long passwords. Fortunately, my bank doesn't disable pasting (Banc Sabadell in Spain). Instead the password is restricted to maximum 6 numbers for login. Yay banks!
- mighty_atomic_c 9y ago6 characters? Let me guess, were there restrictions on character space and case? One place I had an account has a password input that restricts all of those, so it's like an 8-10 character string of all capital letters. I don't understand it at all.
- cortesoft 9y agoYeah, I just disable their disablement. Super annoying.
- 9y ago
- trentmb 9y agoKeypass has a random phrase generator plugin- it's what I use for security question answers.
- pokemongoaway 9y agoI ran into an issue with this a few times... What was the fake birthday I entered?!
- samstave 9y agoFor security questions for sites I dont care about, I pick the subjedt of the question and use that: "What city were you born in" == "city" "what was the name of your first pet?" == "pet" etc.
- justherefortart 9y agoI use profane language since in my opinion the answer should still be hashed if I'm verifying it through the website. Mom's maiden name: InfectedPussyPimple How she got dad, I'll never know!
- pfultz2 9y agoYou can't do that with United Airlines. The answers have to be picked from a drop-down of answers.
- justboxing 9y ago> I didn't believe you when I read this, but you are right. => https://krebsonsecurity.com/wp-content/uploads/2016/08/unitedquestions-580x423.png https://krebsonsecurity.com/wp-content/uploads/2016/08/unite... and.. > Yes, you read that right: The answers are pre-selected as well as the questions. For example, to the question “During what month did you first meet your spouse or significant other,” users may select only from one of…you guessed it — 12 answers (January through December). > The list of answers to another security question, “What’s your favorite pizza topping,” had me momentarily thinking I using a pull down menu at Dominos.com — waffling between “pepperoni” and “mashed potato.” Wow. Source: United Airlines Sets Minimum Bar on Security => https://krebsonsecurity.com/2016/08/united-airlines-sets-minimum-bar-on-security/ https://krebsonsecurity.com/2016/08/united-airlines-sets-min... Video => https://www.youtube.com/watch?v=vmrdLAp7wSw https://www.youtube.com/watch?v=vmrdLAp7wSw
- alanh 9y ago12 possible answers… little better than a 1-digit PIN!
- remarkEon 9y agoOften for security questions like "what was the name of your grade school" or "in what city was your father born" I'll give intentionally wrong answers for the exact reasons you outlined.