8 ms·
Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit ra
by ademup 9y ago
Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.
- naiyt 9y agoSame. It's funny because occasionally when you call support they require you to answer one of those questions. "That's correct, my childhood pet's name was 1xs3^&szx!@!24"
- always_good 9y agoWhich makes it less secure. Customer support rep may find it reasonable to dismiss it as random characters and let the attacker bypass the check entirely. If the attacker knows it looks like gibberish, they can try "Heh, whoops, I just put in random characters at the time. Can we try something else?" I think a false, convincing, and unlikely answer is reasonable. "My childhood dog's name was Alexander Hamilton."
- tempestn 9y agoYeah, picking something reasonable but extremely unlikely and false, then entering it into the pw manager, seems ideal.
- iak8god 9y agoI shares worries I've seen expressed elsewhere that this opens up a social engineering attack vector where an imposter gets through to phone support and says "oh I just typed a bunch of gibberish for the answer and can't remember it." Wouldn't a false, long, maybe hyphenated, but plausible surname be better for this reason?
- city41 9y agoI also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.
- iak8god 9y agoSure, but you're not spending all day running customer service "DoS attacks" against people's bank accounts. Even if "it's gibberish, and I forgot it, can't you please help me out" only works one time out of a thousand, do you really want to bet your bank balance on a weak link customer service rep who's just a tad too eager to help?
- city41 9y agoI think it’s all debatable. That human will always be a weak link. It just takes one representative to forget to ask or get convinced with “oh it’s my wife’s mother’s maiden name and my wife isn’t here and I’m in a real bind”. But in exchange, my security answers are no longer compromisable online. I think overall it’s a positive trade off, but that’s just my hunch.
- iak8god 9y agoWell, for sure it's better than using your mother's actual maiden name. But I'd rather see security questions done away with altogether.
- city41 9y agoI agree, I think they’re a real problem. I think it’s possible to eliminate human error over the phone too. Perhaps design a system that doesn’t let the representative into your account until they type in the 2FA token your phone provides or something (I don’t really know, I’m far from a security expert)
- rat87 9y agoI just wrote a mini rust script (https://github.com/rtaycher/make_password https://github.com/rtaycher/make_password) to spit out 5 random dictionary words for secure passwords I need to share. Everything else gets auto generated by keepass, i should probably just figure out how to write a keepass plugin
- chrismorgan 9y agoTo protect against such attacks, I write some normal English before getting to the randomness, something along the lines of “This MUST be quoted exactly or it is wrong”. That’s ~40 characters “wasted” (they’ll normally have distressingly low character limits, but I find them to normally be at least 50 characters), but I’m optimistic about it offering reasonable protection against such an attack. In practice, I’ve never actually had to quote such a string to anything but a machine, so it is mere optimism on my part.
- borplk 9y agoSame. There was one time when I was forced to read it back to the phone operator. Awkward.
- nly 9y agoThis works great until you call your bank for some reason and they ask you for your moms maiden name. Urgh, it sucks.
- roywiggins 9y agoI use diceware-type passphrases (a bunch of entirely random real words) for security questions for this reason. Bit weird to say "I was born in 'correct horse battery stapler'" but it doesn't seem to bother banking phone reps much.
- QAPereo 9y agoI love just how pervasive the influence of xkcd is! I do the same as you by the way, and no one has ever called me on using something that is obviously not a name.
- r00fus 9y agoThen use a passphrase with no spaces.
- 659087 9y agoI go out of my way to come up with particularly ridiculous answers to these questions in cases where I know someone might eventually want me to answer them over the phone. Birth city: Octopus Mainframe Z7X
- TheSpiceIsLife 9y agoIn the same vein, I always draw a stick-figure horse when I have to sign for deliveries at work.
- chrismorgan 9y agoI’ve toyed with the idea of replacing my signature with 8 random hex characters. Possibly selected spontaneously, different each time. Or writing “handwritten signatures are outmoded; use digital signatures that actually mean something” or similar.
- nickjj 9y agoThe next time I need to answer a secret question that might be used over the phone I'm going to write the answer in as: "No thanks, that information is private and I'd rather not share it over the phone. I know, you're probably going to say that you can't help me without this information and you're doing this to help prevent identity theft but I stand by my choice to not partake in answering your question. Can I speak with a manager?" That should make for a fun conversation.
- waytogo 9y agoOT: Just wondering why so many people are using password managers. When you use a password manager you have one single point of attack and failure. I wouldn't like to give all my credentials to one single entity.
- grzm 9y agoThe password manager is typically on a machine you control. If your machine is owned, you've got issues regardless. A password manager provides a way to effectively utilize higher-entropy, per-account passwords. As with all security-related matters, it's a tradeoff. I expect many choose password managers for this reason.
- 477353468463695 9y agoWell, personally, prior to using a password manager, I had one user name (plus variations for when that user name was already taken) and something like three different passwords for all of my services. The passwords weren't horrible, brute-forcing them would have taken a while, but if you have the same user name and password in many services, then it just takes for one of those services to get compromised to have many of your accounts be compromisable. And generally speaking, unless you're a high-ranking target, it's far more likely for a service to get compromised than for someone to even bother attacking your device. And yeah, sure, I could have just remembered more different passwords and user names, but I'm a human and that requires effort. Now when using a password manager, I can easily choose different user names, e-mail addresses, passwords and far more complicated passwords as well. And all of that with basically no effort. This also improves privacy, as with different user names it's much harder to link up my different accounts' postings. And I can now easily maintain multiple accounts for the same service, too, allowing me to spread out postings across those, so that you can't follow back my post history for all eternity to link up all kinds of information that I've posted over time.