4 ms·

I've long since moved my family to password vaults to store nonsense strings for these password recovery questions and answers, for shielding against precisely

I've long since moved my family to password vaults to store nonsense strings for these password recovery questions and answers, for shielding against precisely this attack vector. Now if I could only get them to adopt 2FA for the master password of the vault.

duskwuff 9y ago
Careful. If the security answers are verified by a human, they may accept "oh, I think I just put in a bunch of random characters" as an answer.
- colejohnson66 9y ago
  Yep. I'd recommend the xkcd[0] approach with Diceware[1]. [0]: https://xkcd.com/936/ https://xkcd.com/936/ [1]: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
  - yourapostasy 9y ago
    Thanks so much for pointing me to that. If I had an always-air-gapped ORWL, I'd probably put a generator on it to be able to quickly generate them; I generate an absurd number of accounts each week, since I don't tie into SSO offers over public sites. Only concern I need to solve for is sifting these lists for confusing words like homophones that are difficult to clearly say the words over an audio-only connection. This drives down the convenience and increases the time to call out the passphrase, since I then revert to the phonetic alphabet. Unfortunately, I've only found various lists [1], but not something that grabs the list, looks up the ExtIPA pronunciation [2] for each word, then applies rules to rank the clarity of each word when spoken over the phone. That last part is where I am stumbling. I can't find the rules that govern what we know about clarity over telephone links, though AT&T must have has studied this at some point. I can come close, with this article [3] about factors that explain why the sounds “f”, “th”, and “s” are difficult for hearing-impaired to hear. Ideally, a ranking of not just individual words in a selected Diceware list, but also ranking of the clarity of a selected passphrase as well, would come out of such a systematic categorization. [1] http://www.stlcc.edu/Student_Resources/Academic_Resources/Writing_Resources/Grammar_Handouts/commonly_confused_words.pdf http://www.stlcc.edu/Student_Resources/Academic_Resources/Wr... [2] https://en.wikipedia.org/wiki/Extensions_to_the_International_Phonetic_Alphabet https://en.wikipedia.org/wiki/Extensions_to_the_Internationa... [3] https://www.hearingaidknow.com/words-difficult-to-understand-with-hearing-loss https://www.hearingaidknow.com/words-difficult-to-understand...
- yourapostasy 9y ago
  TIL, thanks for pointing out that social engineering could probably penetrate lax security operational standards at some companies. All someone has to do is state it's random on every account they already put through with known information but can't answer the password recovery questions upon, put on a flustered & angry act, and I bet some percentage of call center reps will buy it. I'll modify my practice accordingly.

duskwuff 9y ago

Careful. If the security answers are verified by a human, they may accept "oh, I think I just put in a bunch of random characters" as an answer.

colejohnson66 9y ago
Yep. I'd recommend the xkcd[0] approach with Diceware[1]. [0]: https://xkcd.com/936/ https://xkcd.com/936/ [1]: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
- yourapostasy 9y ago
  Thanks so much for pointing me to that. If I had an always-air-gapped ORWL, I'd probably put a generator on it to be able to quickly generate them; I generate an absurd number of accounts each week, since I don't tie into SSO offers over public sites. Only concern I need to solve for is sifting these lists for confusing words like homophones that are difficult to clearly say the words over an audio-only connection. This drives down the convenience and increases the time to call out the passphrase, since I then revert to the phonetic alphabet. Unfortunately, I've only found various lists [1], but not something that grabs the list, looks up the ExtIPA pronunciation [2] for each word, then applies rules to rank the clarity of each word when spoken over the phone. That last part is where I am stumbling. I can't find the rules that govern what we know about clarity over telephone links, though AT&T must have has studied this at some point. I can come close, with this article [3] about factors that explain why the sounds “f”, “th”, and “s” are difficult for hearing-impaired to hear. Ideally, a ranking of not just individual words in a selected Diceware list, but also ranking of the clarity of a selected passphrase as well, would come out of such a systematic categorization. [1] http://www.stlcc.edu/Student_Resources/Academic_Resources/Writing_Resources/Grammar_Handouts/commonly_confused_words.pdf http://www.stlcc.edu/Student_Resources/Academic_Resources/Wr... [2] https://en.wikipedia.org/wiki/Extensions_to_the_International_Phonetic_Alphabet https://en.wikipedia.org/wiki/Extensions_to_the_Internationa... [3] https://www.hearingaidknow.com/words-difficult-to-understand-with-hearing-loss https://www.hearingaidknow.com/words-difficult-to-understand...
yourapostasy 9y ago
TIL, thanks for pointing out that social engineering could probably penetrate lax security operational standards at some companies. All someone has to do is state it's random on every account they already put through with known information but can't answer the password recovery questions upon, put on a flustered & angry act, and I bet some percentage of call center reps will buy it. I'll modify my practice accordingly.