27 ms·
Your Mother’s Maiden Name Is Not a Secret
- tsycho 9y agoHaha, that's why I have been using a made up "mother's maiden" name for the past 5 years!
- gregmac 9y agoThat's not really any better. If a site is hacked that has your made up name, that gets published on the carder sites [1] along with your other information (email, credit card number, phone). It may not work to get a new credit card in your name, but it can be used to reset your password on some other crappy site that uses that information for "forgot password". [1] https://krebsonsecurity.com/2017/12/the-market-for-stolen-account-credentials/ https://krebsonsecurity.com/2017/12/the-market-for-stolen-ac...
- kstrauser 9y agoMy mother's maiden name on exactly one website is "X729gD9naatotKORNKkuV0BwSm4A8GnL". On another it's "7RQCpeaG66ffxxgEoUKwvcSZfj6hEZ3Z".
- jjeaff 9y agoThat may work in cases of online password resets, but I believe it has been demonstrated that they are not great for social engineering reasons. A hacker can just say, "oh I just mashed the keyboard for that" or worse, the agent thinks it is an error or glitch and let's the hacker in. I think best to use a real, but different last name on all your sites.
- yawaramin 9y agoDo most websites have call centres where you can try to trick agents? Also, how gullible are call centre agents at financial institutions? If they're really giving out access to random people claiming to have forgotten the security answer, it's pretty clear-cut the bank should be on the hook for damages if money gets stolen. Nothing like the prospect of having to pay out damages for gullible call centre agents to motivate training agents to be smarter.
- shyn3 9y agoI speak from anecdotal experience here but have seen a bank account password reset using only the confirmation of address, name, DOB and bank card #.
- motherdearest 9y agoAdditionally many institution's gaurd against this by having systems that hide the security question from the customer service representative and only authenticate on a correct answer. If they are showing the "secret questions" to their entire customer service department you don't even need to worry about outside attacks because your organization is ripe from the inside
- always_good 9y agoThe customer support rep once let me into my 2FA Bank of America account when I simply lost my phone. Just had to answer some questions you could find in a WHOIS query. "Surely financial institutions are more secure" is only a pleasant thought.
- Momquist 9y agoIn this case a long passphrase (a la xkcd: https://xkcd.com/936/ https://xkcd.com/936/) is probably the best choice. It still looks legitimate, while being more secure than any random real name.
- maxxxxx 9y agoI use different security questions for each site to avoid this.
- foobarian 9y agoRational or not, I haven't been worried about this kind of abuse of my security form data. Instead I'm paranoid about divulging some very personal facts all over the internet, such as elementary school or details about growing up. It feels like it's exactly what various three-letter agencies might love to get their grubby hands on. As a result anything made up is enough to allay that fear.
- ademup 9y agoEvery time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.
- naiyt 9y agoSame. It's funny because occasionally when you call support they require you to answer one of those questions. "That's correct, my childhood pet's name was 1xs3^&szx!@!24"
- always_good 9y agoWhich makes it less secure. Customer support rep may find it reasonable to dismiss it as random characters and let the attacker bypass the check entirely. If the attacker knows it looks like gibberish, they can try "Heh, whoops, I just put in random characters at the time. Can we try something else?" I think a false, convincing, and unlikely answer is reasonable. "My childhood dog's name was Alexander Hamilton."
- tempestn 9y agoYeah, picking something reasonable but extremely unlikely and false, then entering it into the pw manager, seems ideal.
- iak8god 9y agoI shares worries I've seen expressed elsewhere that this opens up a social engineering attack vector where an imposter gets through to phone support and says "oh I just typed a bunch of gibberish for the answer and can't remember it." Wouldn't a false, long, maybe hyphenated, but plausible surname be better for this reason?
- city41 9y agoI also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.
- Aardwolf 9y agoDoes anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security questions like "mothers maiden name" as backup. No backup questions at all. I guess you go to the bank's office if you forget it? -"wiring" money between european bank accounts is free (and not called wiring, not sure what in english though), for as long as I remember. It's not some special type of transaction, it's the main way to pay bills, get salary, pay each other, ... -paper cheques don't exist since over a decade When I hear how US banking is, it somehow evokes images of an old stuffy 70's office to my mind... lots of paper, maybe a slow cobol mainframe somewhere, which can only support 8 character passwords in all caps or something like that...
- viraptor 9y ago> between european bank accounts is free Between European bank accounts in the same country. Also, not every European country, unfortunately. > paper cheques don't exist since over a decade They still do. They're very rarely used, but they can be useful for cases where you want to buy something like a car without changing the card limits.
- distances 9y ago> Between European bank accounts in the same country. Also, not every European country, unfortunately. As far as I know, it's free between all Eurozone countries. At least I regularly do transactions between countries, and I've never heard it costing a cent.
- kilburn 9y agoTransfers can be charged, and often are even within the same country. In Spain it is common to have "up to n monthly transfers for free, then you get charged x%". Also, I've received wrong payments on a German account from French people many times, and they claim it's because their bank charges the transaction and I receive the sent amount minus fees, with no possibilities for them to specify otherwise (that's happened with dozens of different clients, so I'm very inclined to believe them).
- nkkollaw 9y agoMy bank (Fineco) requires passwords to be 8 characters. Yup, I don't mean minimum or maximum, but exactly 8 characters. That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this. I bet huge numbers are "12345678" and "password".
- Latty 9y ago> I cannot think of a single good reason to impose this. Good? Definitely not, but my money is on CHAR(8) and a lack of understanding.
- chrismcb 9y ago> lack of understanding That is the thing... Id the programs and designers lack understanding of something as basic as passwords what else are they misunderstanding? Sql injection? My other favorite is "use only the special characters...."
- mitchty 9y agoDollar to a donut, there is or was a mainframe involved in authentication that has an 8 character password. I even bet the company that sold it was IBM. I remember finding out at one job that the "reason" for the 8 character password requirement for one of our logins, was "you can type as much as you want, but eventually we just take the first 8 characters and use that to log you into the mainframe as thats all it accepts". Mainframes are weird, and not all that dynamic.
- rhino369 9y agoI’ve seen limitations that even go back to paper records. I worked at a medium sized company where at least 20% of database variables were limited by the number of characters on a paper card system developed in the 50s.
- nkkollaw 9y agoText editors still have a line at 80 characters, which comes from punch cards.
- MistahKoala 9y agoThose of us with double-barreled surnames have been keenly aware of this for quite some time.
- ufo 9y agoAnother thing I am surprised no one mentioned yet is mothers who didn't change their last name after marrying.
- justherefortart 9y agoThe article mentioned it.
- astura 9y ago...or whose mothers never married at all... Or people who don't even have mothers at all. The assumption is also that your mother's maiden name is different from your own name. Which is a very questionable assumption. We certainly show our cultural biases when coming up with these questions.
- stevekemp 9y ago> Or people who don't even have mothers at all. That intrigues me. I can imagine not having a living mother, or even a mother who died before/during/after childbirth. But I can't imagine how it is possible for a child to have no mother at all. Is there a situation that you demonstrate ?
- seceng 9y agoAdopted by two fathers.
- twobyfour 9y agoA child whose father(s) commissioned an egg donor and a surrogate? An adoptee (of a father or fathers) who never knew who their mother was? An orphan who never knew who their mother was and lived in an institution their entire childhood? Sure, everyone has at least one biological mother. But there are plenty of people who don't and never will know their biological mother's name.
- caseysoftware 9y agoMother's maiden name is one of the easiest. If she's on Facebook, odds are it's listed because that's how her high school friends knew her. Alternatively, if grandma & grandpa are listed, you can go there too. I've been presenting on these flawed questions for years. In one of my demos, we take a volunteer from the audience and we see how many of the top 10 banking questions we can answer from their public Facebook & LinkedIn profiles. I've never gotten less than 4 or more than 8.. and - as an attacker - I'd take those odds.
- senectus1 9y agoUntil very recently my bank here in Australia was limiting the complexity of passwords. no more than 10 characters, no special characters. utterly ridiculous.
- dukeflukem 9y agoName and shame em
- senectus1 9y agoUsed to be called Police and Nurses. Now its P&NBank. But they've just relaunched their whole digital banking solutions... its a lot better now.
- deleted 9y ago[deleted]
- dizzystar 9y agoI give the bank a fairly obvious fake last name they could spell without asking me, since it's famously attached to a bumpkin. I get a lot of strange looks for that one. I can barely remember how to spell my mother's maiden name since it wasn't anglicized. Interesting to note that overseas support really struggle with a lot of these security questions. So many are central to the Western world and they can't seem to spell it at all because they aren't familiar with our culture. I never once felt like those security questions are secure at all. Some are just horrible, especially the maiden name one and birth city. Granted, the password manager works well for technical people, but it doesn't work for non techs or anyone who's had a bank account for more than ten years or so.
- brewdad 9y agoThankfully, I have zero ties to my birth city since my parents moved to a different state before I was a year old. Sure, it wouldn't be hard to find in a records search but it's not going to be sitting there in my social media profile at least.
- deleted 9y ago[deleted]
- yawaramin 9y agoI feel like this article takes a lot of words and time to suggest the reasonable solution: make up fake answers to security questions and store them somewhere, preferably a password manager. Sure, it would be greatly preferable to use 2FA and people should really get on that, but lamenting on all the ways security questions can be inappropriate for people when there's an obvious solution feels like drawing it out for the sake of filling up that word count.
- zaptheimpaler 9y agoSure there are workarounds we can use as consumers, but getting the message out there will help push the companies to a better system. Something like 2FA over SMS is common in other countries and way better. Journalism is helping give security a bigger mind share in the public eye so they can understand how current systems are flawed and demand better ones. Its a good time to tackle the problem given all the recent hacks/leaks (like SSNs). Corporations will only budget for this stuff when their users demand it.
- Abishek_Muthian 9y agoConsidering the security question forms are brute-force proof, I think it's better to keep fictional answers which cannot be accessed by social engineering for these questions. In India we have SMS based 2FA for transactions in spite of these questions, Some Chinese banks seems to provide HW based 2FA for general accounts.
- deleted 9y ago[deleted]
- tempestn 9y agoBest line in this article: Then there’s the State Bank of India’s vertiginous “What is the website that you rarely visit?” which reads like a Zen koan whose purpose is to make you reflect on the unknowability of the answer. (Although, I think it could actually be a decent one for some people; you could probably mentally associate it with a specific site and have a decent chance of remembering in the future. Not as good as random answers stored in a password manager, but better than most security questions.)
- u801e 9y agoWhat banks should really do instead of just using passwords or 2-factor authentication is to use client TLS certificates in addition to the standard username and password. The bank can advertise instructions on how to generate a certificate signing request, have you bring it in when you open an account, have the bank issue you a client certificate and have them give you instructions on how to import it into your web browser. The bank can also tell you to do this for each device you plan to use to access your online account(s).
- motherdearest 9y agoI can just imagine my mother getting flustered after reading the words "certificate signing (sic?) Request" and stop reading at "client certificate". I can think of very elaborate security measures. The trick is to make them sound easy and relatable to a ranch hand and 1960s housewife. These people smart but they don't have the same life experiences
- u801e 9y agoIt may sound difficult at first, but with plenty of help (step-by-step tutorials, etc.) provided by the bank, then it shouldn't be too hard to implement. It could be started as a trial for a certain subset of customers and then rolled out to larger and larger groups as time goes on. Banks could provide an incentive by stating that using this is much more secure than just using a password, and that it's also largely automatic (unlike 2FA).
- sethammons 9y agoIn school, did you ever do the "give instructions to make a peanut butter and jelly sandwich" activity? I'm guessing not. I'm willing to bet you could have a video with transcript and pictures of the user's exact home set up and many people still couldn't figure it out. You are dealing with people who still don't understand why you don't have to double click links since they have to double click apps and don't know the difference between Google, the Internet, and Internet Explorer. People are often stuck with modes of thought and operation from when they were younger, and for many, that was pre-computer. At work, we got a hand written letter asking for support setting up their account because they were having trouble with their email that their daughter set up (despite ample support options on the site).
- Sam_Harris 9y agonon-paywall link?
- cmurf 9y agoSet a "verbal password". Most banks support these, but most customer service reps haven't heard of them (this is slowly improving). And it seems if you "forget" this verbal password there's no guarantee the bank won't give you an alternate work around like asking for more answers to stupid security questions. Anyway, it's worth a shot: https://krebsonsecurity.com/2017/11/simple-banking-security-tip-verbal-passwords/ https://krebsonsecurity.com/2017/11/simple-banking-security-...
- hnonlyforu 9y agoIt's worse for me, cause Chinese people don't change names when married. It is zero-effort to learn the maiden name since it is still their actual name. However, many Chinese websites still have this question available. I always give a fake name/addr/, etc. Very hard to remember all those answers, before I know how to use a password manager.
- saagarjha 9y ago> And how many Indian- or Brazilian-born users went to a high school without a mascot, or grew up on a street with no name? Was helping my (Indian) grandfather and came across a similar issue–very little applied to him. We finally got him to settle on some questions, but then when he forgot the password and went back to reset it, it kept dinging him because one of the questions was like “what was your third grade teacher’s name” and he had forgotten how he had Anglicized it.
- chx 9y agoI'd say my mother's full maiden name is pretty hard to find (I am not American) -- until, of course, someone finds it in one of the breached database dumps. If I were indeed using her name.
- waytogo 9y agotl;dr security questions are insecure because most questions are flawed (like what's your mother’s maiden name)
- AndyMcConachie 9y agoIf you want an absolutely egregious example of how bad this can get here is an article I wrote a few months ago about the security practices of an American Credit Union. https://metafarce.com/lafayette-federal-credit-union.html https://metafarce.com/lafayette-federal-credit-union.html
- PeterStuer 9y agoSites? When I call my bank to de-block my debit card after 3 wrong PIN attempts, they use the same 'security questions' to 'secure' the call (establish that it is truly me calling).
- HenryBemis 9y agoI wonder if all this Mother's Maiden Name secret started in The Exorcist(?)
- aylmao 9y agono shit
- dang 9y agoPlease don't post unsubstantive comments here.
- keir-rex 9y agoIt is a secret if you answer the question incorrectly and only you know what the real-fake answer is!
- nickjj 9y agoI always thought security questions were a ploy to get you to take surveys without explicitly being told you were taking a survey. If your bank (or any company who has your gender and birthday) asks you what your favorite color is, they could now come up with stats such as "83% of women in between the ages of 23 and 38 prefer purple". That type of data could be sold to and be used by clothing vendors and other businesses. It's also 1 more data point collected on your private life.
- blisterpeanuts 9y agoPossibly, but at least some people don't actually give real answers. It's better to have a set of nonsense words for these "security questions". Much safer to say your mom's maiden name is Zxxxxxy6ghjki.
- llukas 9y agoIn EU they need to explicitly state that data is collected and reason. Data uses for authentication cannot be used for marketing.
- mmcnl 9y agoThis seems to be primary an American thing. I have never experienced the usage of security questions with non-American companies. Even Apple uses it, which is weird considering they're so proud of their privacy-first strategy.
- zulln 9y agoWrote about this a week ago: https://labs.detectify.com/2017/12/20/security-questions-are-not-secure/ https://labs.detectify.com/2017/12/20/security-questions-are...
- exabrial 9y agoIn 2018, anyone here that is working on an internet facing application should push for TOTP or U2F, please. Texting, security questions, et all, are nothing but security theater.
- arikrak 9y agoMost sites just send password reset info to your email. I thought these questions are usually used just as an extra layer on top of that? So someone would need to hack your email and guess your question, which makes it less of an issue if you keep a secure email account.
- erroneousfunk 9y agoIn a computer security class I had at Harvard, the professor made the comment: "Your mother's maiden name is considered a 'secret.' Which is funny, given the building we're in." We were in the Maxwell Dworkin building, named after the surnames of Bill Gates' and Paul Allens' mothers. Their mothers' maiden names were literally carved in a huge stone sign outside the building.