20 ms·

Don't give away historic details about yourself

532 points by zeveb 9y ago

ConceptJunkie 9y ago
The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions they use are often easily guessable (although it seems now they are using somewhat better questions). Nevertheless, my attitude is that I'll just make sure to retain the password. I get the possible security risk of answering quizzes on places like Facebook, but I've done it a few times because it's fun. It all boils down to passwords being a hassle. Almost anything you do to make dealing with passwords easier makes them less secure, but there's nothing better. The only improvements over passwords come from additional authentication factors, like having to grab a code messaged to your cell-phone, or using one of those little security token devices (or the software equivalent). I don't think anything is going to be replacing passwords any time soon.
- wycy 9y ago
  Typically using a secret question also requires you to have access to the email account you signed up with, so it's almost 2FA at that point.
- downer61 9y ago
  Hashing a salted string of "an answer" usually works. Phone operators try to ask you the question, though, and you sit there for five minutes reading off hundreds of characters, and everyone is suddenly having a bad day, which I find hilarious. The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me. The obvious corollary though, is that there really are organizations with systems that using publicly available information about, mixed with misinformation to see if you can discern an "accurate-ish" (which is sometimes not correct at all, even if you know what they think the correct answer is), and they don't even give you options about what public information they're going to select, to verify your identity. It's usually a brief questionnaire about previous addresses, associated last names, states you paid your taxes in, and it deeps the impression that there are simply gaping, flawed security gaps at the core of everyone's financial factoids, because it's also sourced from poorly conceived paper-based bureaucratic files that never had any hope of being accurate from the outset.
  - ghfbjdhhv 9y ago
    >The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me. The person on the other end of the phone had nothing to do with it.
    - downer61 9y ago
      My hope is that the ambient animosity seeps through, via high turn-over, leading to increased personnel costs for the organization. In general, hopefully this uncooperative behavior adds to the general misery distributed throughout the world, and all just because security goons need to feel like they're smarter than the people subject to their policies. Consider this, oh reader, should you have the opportunity to alter password policies for a project your working on.
      - icebraining 9y ago
        Clearly you haven't done customer support, if you think having to listen to a long string of characters is what's going break them :)
    - jjeaff 9y ago
      For me, as an early stage startup, my devs are actually doing some customer service. I find it has helped our UI/UX immensly because they have to deal with all the problems directly. I actually think it is a great idea to let your developers spend at least a little bit of time each week (or day) doing customer service. It's amazing how much faster little bugs get fixed and processes get streamlined.
- nmstoker 9y ago
  Indeed, they're only slightly less stupid than considering SSNs to be secret and then using those. As others also suggest, I always make up the answers, different per counterparty - there's no way I fully trust places like my work to keep these details securely, so it's worth compartmentalizing the risk
- thefifthsetpin 9y ago
  I do the same. Once, a bank asked me over the phone what my high school mascot was (or whatever) to verify that I was really me. I hadn't expected them to use the question in this way, so I wasn't prepared to look up my answer. Knowing whatever randomly generated string I'd used was likely unpronounceable I answered, "I could teach you to pronounce it, but first you'd need to cut out your tongue." which they accepted.
  - teamhappy 9y ago
    > which they accepted That's not great.
    - sbov 9y ago
      Yeah, this is why I use "lies" rather than "randomly generated string".
    - tajen 9y ago
      I confirm here. Another bank accepted for me.
  - PebblesRox 9y ago
    This happened to me but I’d chosen the “write your own question” option, so the lady asked me “what is [childhood imaginary friend]’s middle name?” I told her the answer and she said “that was cute.” I never expected an actual person to ask me the question!
- hw 9y ago
  SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.
  - pacala 9y ago
    Doesn’t 2fa mean password + phone? How is getting the phone sufficient?
    - shakna 9y ago
      You can often reset the password if you can intercept the chosen token generator, like SMS.
  - jackhack 9y ago
    In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear. It's disgusting how twisted these criminal activities have become.
    - sitkack 9y ago
      I remember a reading about an activist that had all of their online accounts wiped by this vary mechanism. They had 2FA protecting everything, but someone called their cellular carrier and switched their account over to a new SIM. They then did password resets on all the accounts and wiped them. Every alternative way in is a larger attack area.
    - aaron_m04 9y ago
      How does the phone number get identified? You would think that'd be confidential.
- simonw 9y ago
  I agree, secret questions are dumb... but what are the alternatives? The majority of human beings now manage important parts of their lives online, which means they have to remember passwords. Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one. Secret questions may be revoltingly insecure, but they do at least let people get back into their accounts. We need to do better, but I don't know what "better" looks like.
  - gnulinux 9y ago
    > Humans are TERRIBLE at remembering passwords This is the main problem and we created this problem. Over the last 30 years we worked so hard to make passwords weird and not even that hard for computers to try find. If your password is a sentence that you know by heart, say your favorite quote, the motto of your country, of your school, or some cool fact etc... your password would be (1) safer and (2) easier for you to remember. That's what I do and I never have hard time remembering my 4 to 6 word password. I just use bunch of books/movies and remember my favorite quotes. For example "one ring to rule them all" is a good password, or "may the force be with you" or "call me ishmael".
    - Simon_says 9y ago
      Are you kidding? Those are terrible passwords, and there’s already some script kiddie out there with a password list containing the top 10 billion book, music, tv show, and movie quotes. A good password has entropy, which is not a property of the alphanumeric string but of the process used to create it. Could your password generation method plausibly have produced 2^60 alternative passwords with equal probability? Probably not. Also, never reuse passwords.
      - dsfyu404ed 9y ago
        Are you kidding? Which is longer, the alphabet or the dictionary? There's a hell of a lot more words in any language than there are characters that make them up. N case insensitive words is far better than N character password from the normal set of characters (alphanumeric + special characters). Even if you restrict the combinations of words to grammatically correct sentences there's still more combinations than there are of for the same number of characters That still holds even if you make assumptions about sentence structure, common word combinations, etc, etc. There's a lot of words out there.
- senorjazz 9y ago
  I nearly lost my google account that way. I gave a nonsense answer totally unrelated to the question as I knew I would never forget my password. Was in a different country, got locked out, had to give my security question answer.... oh dear. After about 3 months occasionally sitting down and just trying out random things I meant have entered I managed to get it back.
  - testplzignore 9y ago
    I've lost an account on another service this way. They did a forced password reset. To set a new password, you had to go through the forgot password flow, receive the email, and then answer the security questions. You would think that if the passwords were compromised, the (probably plain text) security questions were certainly compromised.
- Jeremy1026 9y ago
  When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she was baffled when I told her the question selected didn't matter, and the answer was a seemingly random alphanumeric string. I told her that I don't know her, or her machine. For now, I'll be setting it as quick, easy for me to remember, string and I'll change it to a different one when I get home.
  - gnulinux 9y ago
    I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.
    - r00fus 9y ago
      So use passphrases that adhere to your security requirements (upper/lower/symbol etc)
    - jstarfish 9y ago
      > Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A METH-FUELED SWINGER PARTY IN A CHEAP MOTEL etc.
      - gnulinux 9y ago
        My problem with that is remembering and generating it. First problem is easy to solve with password managers but you still have to generate an ideally long car name with no bias. If you put some bias, then it might be backtracked. You can have a dictionary of possible car names but then you're open to attack if that dictionary is found or predictable enough that someone else can compile that list. It just doesn't feel secure enough to me.
- smsm42 9y ago
  The funny thing is the search space for most of these questions is so narrow. I mean, they ask for colors (how many are there? how many average person can name?), city names, personal names, baseball teams, school mascots, etc. How easy is it to compile a dictionary for all of those? Probably won't take more than a day. > I've always given false info to those, when I bother to fill them out at all Average person, not trained in using password managers, won't do it. In fact, most password managers don't support those, so you need secondary secure storage. Chances of a layperson setting up one properly and consistently using it is close to zero. > Nevertheless, my attitude is that I'll just make sure to retain the password. The problem is, on some sites, if you know these questions you can just reset the password. Which is insane, but unfortunately happens.
  - QasimK 9y ago
    Honestly you need a better password manager if it doesn’t allow you to store arbitrary notes or secret question/answer pairs.
- enobrev 9y ago
  I agree with you and for accounts that matter (bank, etc), I'll generally generate additional passwords with my PW manager for each question and store them there. That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singular favorite things? How the hell should I know what my favorite movie was 3 years ago when I rushed through some account creation process on some random website?
  - StavrosK 9y ago
    They stop making new movies when you answer that question, thus ensuring your answer will remain valid.
    - jstanley 9y ago
      That still doesn't stop you stumbling across an older film that you've never watched before, and then finding that you like it more than your "favourite".
      - StavrosK 9y ago
        Wait, you answer the question before having seen every single movie? How irresponsible.
        lfowles 9y ago
        I tried my best but the session timed out before I had even finished one movie.
      - bigiain 9y ago
        Simple - we'll destroy every film in existence after you've asked that question. You get to be "the movie guy". That guy over there is "the book guy". The one in the corner who everybody hates? He's the one who had to use his first girlfriend's name...
  - 9y ago
- cmurf 9y ago
  Exactly. But having to come up with fake answers to stupid questions and track them, is just proof of how bad some people are at their job. Apple still does this kind of crap. Actual questions: In what city did your parents meet? What is the first name of your best friend in high school? Recently an airport public WiFi in a major city in Europe wanted my birthdate and the agreement language said that I acknowledge everything I'm stating is true and correct. It's so blatantly asinine. I didn't even bother to look if it cited some EU law that lying is a crime, I just said fuck it, and went without Internet for a few hours.
  - ryannielsen 9y ago
    Apple still does this kind of crap. Not for users who've opted into two-factor authentication: https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915 From the page: Do I still need to remember any security questions? No. With two-factor authentication, you don't need to choose or remember any security questions. Your identity is verified exclusively using your password and verification codes sent to your devices and trusted phone numbers. When you enroll in two-factor authentication, we will keep your old security questions on file for two weeks in case you need to return your account to its previous security settings. After that, they will be deleted.
  - MzxgckZtNqX5i 9y ago
    One thing that really drives me crazy is that Apple asks me my security questions even if I enter my correct password because I haven't logged in for a while. I didn't saved the answers (and this is my fault) but anyway I would have done it in the KeePass database that contains also the password, so no additional security.
    - zepolen 9y ago
      They do that to remind you of the security answers. Still a broken model over all.
      - MzxgckZtNqX5i 9y ago
- samstave 9y ago
  I love the following technique: Question: What was the name of your first cat? A: cat Q: what city were you born in A: city Q: what is your moms maiden name? A: name and the like.
  - FreeFull 9y ago
    Now that you shared it here though, someone might try this on you.
- acchow 9y ago
  Square Cash is passwordless. They move money around.
- pieguy 9y ago
  I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options! Sometimes my answer would not be shown and the correct answer is "none of the above", but otherwise my answer sticks out like a sore thumb.
  - furyg3 9y ago
    This, too, was my problem. I don't want to give out real answers to my security question for two (slightly contradictory) reasons. The first is: what if this site is hacked? Now my security question answers are floating around for use on other sites that ask similar questions. The second is: some of these questions are pretty easy to find the answer to, or guess. So I used a generated string for those questions, too. Generally worked, but sometimes made for some interesting phone calls. "My mothers maiden name is <random string>. You can guess why she took my father's." Then they started reading back random choices, which made it pretty easy to guess what I picked.
    - derekp7 9y ago
      I have a third problem -- often times, the list of questions they ask are non-sense to me. "What is your favorite food?" I don't have a favorite, and can't think of anything that I'd remember later. "What was the name of your first pet?" I never had a pet. "What was the name of your high school sweetheart?" Gee, thanks a lot for stirring up bad memories.
      - Trundle 9y ago
        Here's a fourth that was actually responsible for me starting to just use generated passwords for those as well. They told me my answer wasn't valid. According to them, it's impossible for your mothers maiden name to have less than six characters :/
        mighty_atomic_c 9y ago
- harikb 9y ago
  I have always wondered what happens if the receiving site is someone like IRS or any such government entity. If one of the questions was "where was your father/mother born?" and you gave a fake answer.. are you now "lying to the government"? There are lot of questions that can have provable right/wrong answers - assuming someone powerful is out to get you. Imagine that being used against someone!
  - brewdad 9y ago
    I'm not even 100% sure where my mother was born. Her family moved around a lot back then (military) and her and each of her siblings were born in a different city. She passed away almost two decades ago, so it's not like it would ever come up now. I guess I could try to find her birth certificate somewhere in my dad's papers assuming he still/ever had a copy.
  - mseebach 9y ago
    I don't think lying to the government is automatically illegal (ymmv, ianal, probably varies with jurisdiction). They are generally pretty explicit about the contexts in which lying is illegal (certain signed forms, being under oath etc) which would imply that lying is at least not illegal in other cases. This is not, by the way, a strictly government related concern. If you lie on a credit card application (and are caught), you're going to have a bad time. But the signed bit of the application is usually completely different from where you're asked to set up "security questions".
- stronglikedan 9y ago
  I know it may be to my detriment some day, but I just use the same answer for all secret questions everywhere. It has nothing to do with anything I've ever encountered, anywhere I've ever been, or anyone I've ever known. I do use a password manager, but my bank will ask secret questions to register new devices, so I've resorted to this tactic to reduce the hassle.
  - Mikeorias 9y ago
    Let's hope you won't have to regret sharing this information too publicly...
- blauditore 9y ago
  Does Apple still do this? I always wondered how they're glorified for Privacy and Security while pulling this off...
- frenchman_in_ny 9y ago
  What's worse these days is, ever since the Equifax breach, certain institutions have taken to asking me for the last 6 digits of my social (or even worse... all of them...)
  - sitkack 9y ago
    The last 4 or 6 are the ones with the most information. The preceding 3-5 digits are handed out in blocks to the states. So if you roughly know when and where someone is born, you can guess their prefix. http://www.ssofficelocation.com/social-security-number-prefix http://www.ssofficelocation.com/social-security-number-prefi...
  - Retra 9y ago
    SSN isn't even a 'secret' number. Military folk have it on their ID tags and you're supposed to give it up if you're a POW. If you're supposed to give it to your enemies, then how is it private info?
- zamalek 9y ago
  I store my automatically generated secret answers in my password manager.
- m0rganic 9y ago
  The pupose of the “security question” is simple.. if a user needs to recover their password then the next best way to verify authenticity of the password reset request is to verify they know the answer to a few pieces of information they have previously shared with the service. In the age of mobile devices and 2FA, this becomes a lot less relevant but is still a very viable alternative because it’s accessible and difficult to crack if done right.
  - m0rganic 9y ago
    also if answers to those questions alone has given you access to your account it is most certainly implemented poorly. Typically access to the account would come in a 2nd factor form like clicking on a reset password link from an email account that is yours and previously configured for such service. Only then would you be allowed to provide a new password to recover the account. Brute force protections like ensuring only a finite amount of failed attempts are necessary.
deleted 9y ago
[deleted]
gregmac 9y ago
Underlying this, don't ever answer these stupid 'account security' questions truthfully. Better to make something up and store it in your password manager along with other account info. I'd normally be tempted to put in the same types of random passwords I normally use, eg: > What was the name of the street you grew up on? L9Pro840Of9KNIGfKD4tf8tOwTG9Dcqj Unfortunately, I've heard you can talk to customer support and say things like "I think I just typed in random garbage for that" and they'll accept it. Whether an attacker would know or try this I'm not sure, but I could also see a customer rep hinting towards this when they see it. It's probably better to actually make up something plausble-sounding but incorrect, like "Summit Avenue". (Related: there's a website for this [1]) [1] https://www.randomlists.com/random-street-names https://www.randomlists.com/random-street-names
- fenwick67 9y ago
  A heuristic where you transform a truthful answer might be better. i.e. your first car was a Bronco, security answer = hash('bronco'+secret).slice(6)
  - coldacid 9y ago
    The problem with that is that it goes back to being gobbledygook for which the operator will accept "I just smashed the keyboard for it".
  - jjeaff 9y ago
    My issue is that most of the time, the available questions are just frustratingly dumb. I don't have a favorite song, favorite movie, or favorite food. I like lots of things and those things change over time. And seriously, favorite teacher? That's very common. How many people really have a favorite teacher.
- jetrink 9y ago
  Another option is an XKCD-inspired[1] 'correct horse battery staple' passphrase. I understand that using such passphrases in other contexts like encryption is controversial due to their relatively low entropy, but I think customer support is an ideal application for them. 1. https://xkcd.com/936/ https://xkcd.com/936/
abhiminator 9y ago
A good idea to counteract privacy risks of this sort is to occasionally search yourself by your full name or by username (one that can be traced back to you, that is) across all major search engines and see if any of your data is out in the open in any public forum. Same goes for searching your phone numbers, physical addresses and your email address (preferably in double-quotes for an exact match) -- I discovered mine stashed in a blog full of random email address in which my ID was a part of -- reported it to Google and it was gone in a couple of days. I perform this 'exercise in privacy' once every three months -- which for me is the average time in which I sign-up for a new service or product using my primary email address; YMMV. A related article for those who're interested (shameless plug) -- https://abhishekbalaji.wordpress.com/2016/09/24/why-you-should-occasionally-google-yourself/ https://abhishekbalaji.wordpress.com/2016/09/24/why-you-shou...
- yuriyb 9y ago
  Google provides a way to "subscribe" to email notifications of new search results for a given term (don't have the link handy right now). I've been subscribed to results for my full name for many years, and occasionally get an email of a new mention here and there.
  - abhiminator 9y ago
    I think you're referring to Google search alerts[0]. I agree, that's a pretty neat tool to be subscribed to, should be useful in drastically cutting down the response time when responding to instances of one's personally identifiable data leaking on the web. [0] https://support.google.com/websearch/answer/4815696 https://support.google.com/websearch/answer/4815696
- shostack 9y ago
  What was the mechanism by which you reported it?
  - abhiminator 9y ago
    I reported the blog that was hosting the violating content, not the particular search result in question. My apologies, should have made that clear in my earlier response.
lucb1e 9y ago
So let's get rid of security questions and we can just carry on? There should be no harm in disclosing information which is already known by dozens of people, like your mother's maiden name or your first pet. Going around and telling everyone "keep your history concealed!" is just silly and will get you the tinfoil hat label, making any future security advice useless. I typically agree with him but this just seems like attacking the wrong problem.
- asfgionio 9y ago
  I am not entirely sure I agree. Maybe it's slightly paranoid, but I find it shocking how much information people share on the Internet. I still abide by the old idea that you never share personal information on the Internet.
yuriyb 9y ago
I've never provided literal, logical answers to security questions, as even without sharing the answers elsewhere, the logical ones would be entirely too easy to guess. "Make of first car?" There are only so many vehicle brands reasonably accessible in a geographical area - not hard to brute force. "City of birth?" Common knowledge among all my friends. It's too easy. An appropriate answer to "Make of first car?" would be something like "red &5 Blueberry."
- saalweachter 9y ago
  So it's a common trope in science fiction that super-intelligences will resurrect historical people using DNA and mumble-mumble to get their memories. We finally have a plausible answer to how computers a thousand years from now will be able to reconstruct the details of your life: security questions.
HugoDaniel 9y ago
I was born in 1900/1/1
- pbhjpbhj 9y ago
  You must like scrolling, I was born in 19__/1/1 where the missing digits put less wear on my mouse wheel.
benpiper 9y ago
Don't give out your birthday either.
quantumfoam 9y ago
I usually just do a random hash. Also, really, really hate the sites that do not allow you free form text the question itself and rather populate a bunch of commonly known ones. FFS, if you're a web developer working on security questions, let the user make up the question. Agreed though, we should just do away with this as an authentication factor.
- PebblesRox 9y ago
  Let the user make up a question and remind them that they might need to answer it over the phone so they don’t choose something embarrassingly personal.
United857 9y ago
United Airlines is probably one of the worst I've seen: http://www.slate.com/articles/technology/future_tense/2016/03/united_airlines_uses_multiple_choice_security_questions.html http://www.slate.com/articles/technology/future_tense/2016/0... Not even free text but only allowing a limited set of answers via dropdown menus (most of the provided answers don't apply to me either, so it's both insecure for them and hard for me to remember as well)
- et-al 9y ago
  I tweeted at them about this when those dropdown answers came out and they actually responded to me, but never took action to change things. The official United response on FlyerTalk (linked from the Slate article) is naïve to say the least: > We purposely chose to use preregistered answers as our first form of enhanced authentication to protect against this keystroke logging. We need to ensure that all of our customers have a high degree of security and our research also indicated that some customers had self-entered security answers that would be very easy to guess. Wow. Source: https://www.flyertalk.com/forum/26212495-post233.html https://www.flyertalk.com/forum/26212495-post233.html
pwinnski 9y ago
Using random characters for answers to "secret questions" only works when you can be 100% sure you will never have to give the answers over the phone. If you ever have to do that, random characters are worse than reality, because phone reps will just say, yeah, you're right, it's gobbledygook. I give arbitrary answers that would make sense to something like an AI. Like, "Q: Who was your father's first employer? A: Avocado flesh" or "Q: What is your mother's maiden name? A: Rutherford B. Hayes" Of course, all such answers are stored in my password manager.
ourmandave 9y ago
Stealing one account at a time is small time hoodlum level sh*t. The pros just download the entire user table in one go. They don't care what your first pet's name was.
- Simon_says 9y ago
  Unless you’re famous or wealthy. Has happened numerous times.
- PrimHelios 9y ago
  It doesn't matter if the person after your account is a skid, or is a government-backed entity, you lose all your data and online accounts either way.
Reedx 9y ago
I don't know which annoys me more, the easy to guess security questions or those with mutable answers. Things like: What's your favorite vacation spot? What's your favorite food? Often you're stuck having to choose between something other people know or can figure out (where you were born) and something that may well change over time.
- saalweachter 9y ago
  I like the idea of trolling people with security questions that you never actually use in a password-recovery workflow. What is your third favorite vacation spot? Would you rather fight a horse-sized duck or 100 duck-sized horses? For how much money would you go to jail for 1 year?
  - jgroszko 9y ago
    I was always a fan of these nihilist security questions: https://www.mcsweeneys.net/articles/nihilistic-password-security-questions https://www.mcsweeneys.net/articles/nihilistic-password-secu...
    - et-al 9y ago
      The New Yorker published a cartoon along that vein last year with "Insecurity Questions": https://www.newyorker.com/humor/daily-shouts/insecurity-questions https://www.newyorker.com/humor/daily-shouts/insecurity-ques...
  - bdefore 9y ago
    I've just chuckled for far too long visualizing your horses and your ducks. Now everyone here at this cafe thinks I'm some kind of animal murderer.
makecheck 9y ago
The thing they never get right is that the answer to a question is only useful if you can write the entire question. You should never be forced to select a question from a list. Also, I can’t believe how stupid some of these sites’ questions are. While I always make up the answers, frequently they require at least 3 questions and only 1 or 2 even apply to me (assuming I answered truthfully)! And one airline wanted FIVE of them!!!
cheschire 9y ago
I've been really concerned about how freely people seem to give their DNA away to testing services like 23andMe or Ancestry DNA. I just get this feeling that in the next few decades genetic code may become the pinnacle of biometrics as a part of multi-factor authentication. i.e. something I know, something I have, and something I am. And DNA databases that are potentially loosely secured, or at least secured as well as credit bureau's data, seem like a great way to unwittingly expose one's future self. I bring this up because multi-factor authentication still seems to be a struggle to implement well for the masses, and while people here complain about these personal questions being insecure, I can't really think of a reason why genetic code won't become the ubiquitous standard for the vast majority of the population to prove their identity. Yet here people are giving it away, and even paying for the privilege.
- nanomonkey 9y ago
  DNA can be harvested from dead hair, skin or spit even, so anyone with access to your physical environment could obtain your DNA.
  - cheschire 9y ago
    Yeah, I was considering more along the lines of massive compromising of remote authentication mechanisms, not spycraft targeting.
    - beenBoutIT 9y ago
      LMFAO.
  - logfromblammo 9y ago
    It should really be considered public information. You leave your DNA everywhere you go. Like all biometrics, the most it should be used for is identification, never authentication. You're still going to need a secret, and maybe also a token.
    - deleted 9y ago
8bitsrule 9y ago
The first thing to think, when a website (or stranger on the street) asks you an out-of-the-blue personal question is: why is s/he asking? Cuz it's probably not because they give a crap.
mindslight 9y ago
What is with perpetuating this idea that people have some duty to be responsible for companies' broken security practices? You're unable to prevent their fuckups - so you can only take steps to make sure you don't end up on the hook or otherwise severely impacted due to their negligence. It's not my job to avoid repeating public information like mother's maiden name, historical addresses, etc. Nor is it my job to worry about whether a bank will bypass confirming "secret question" strings for anyone stating they're just random letters. As an non-responsible third party to any possible identity-based fraud, the only thing I see the need/ability to do to protect myself is watch transactions on my accounts (automation helps here, eg OFX), and be prepared to send demand letters/sue the surveillance companies for libel if they start spouting off that "I" opened accounts that I did not. Feeling any more responsible than this is just helping to continue their negligent/lazy/broken-ass business processes.
- philwelch 9y ago
  I don't really see "responsibility" as a useful lens. If you give away information that can be used to reset your passwords, you make it more likely that someone can reset your passwords. Assigning blame is something people do to make themselves feel better after bad things happen. Making it less likely for bad things to happen in the first place may or may not be worth the time and effort, but whether or not you're morally responsible is a pretty meaningless question.
  - mindslight 9y ago
    > Assigning blame is something people do to make themselves feel better after bad things happen Eh, not really. Assigning responsibility is how we align incentives to prevent things from happening in the first place. You are responsible for not disclosing your bank password. You are not responsible for repeating public information that a bank foolishly decided to consider an authentication token. Personally fretting about whatever broken actions a bank decides to take uses up a disproportionate amount of your time, as you're unable to actually change them. And any success just encourages the bank to continue, as they suffer less from their own idiocy.
EGreg 9y ago
I think you have it backwards, here. Instead of urging people to NOT reveal details about their life such as their first pet’s name, you should urge them to answer all password reset questions with at the very least irrelevant answers, or a password reset password.
rdiddly 9y ago
That's why the answers to the security questions are always random strings, and the answers to the quiz questions are always "your mother." e.g. I learned to drive stick-shift on your mother. My first pet was your mother. My special furry friend is your mother. And so forth.
hateful 9y ago
I was born in the US, raised on TV and now I reside on the Internets.
zzm 9y ago
As others in this thread have stated, security questions are less secure than using a password, and thus, a poor way backup to passwords. One interesting alternative that's been presented recently is Mooney Images [1]. The example images in the linked slides are fun to test out on yourself and others. They rely on a user's implicit memory of visual imagery and while they are also susceptible to similar sorts of side-channel inquiries, they would be much more obvious. [1] https://www.mobsec.rub.de/media/mobsec/veroeffentlichungen/2017/03/08/MooneyAuth-NDSS-2017.pdf https://www.mobsec.rub.de/media/mobsec/veroeffentlichungen/2...
rabboRubble 9y ago
I use 1Password as a password vault. Some years ago, I decided to start lying for secret question answer challenges. I use 1Password to generate a string of garbage (without numbers or symbols, 25 characters long) and keep that answer in a custom field in the 1Password vault. I've tagged those entries with a security tag to find all accounts with secret Q&A information. I am paranoid about back ups because if god forbid I lost that vault, there are accounts that would be permanently lost to me.
- itakedrugs 9y ago
  One problem with this is social engineering... someone could call the company to recover their password and say that they entered garbage for the security question... I started to enter passphrases instead
  - rabboRubble 9y ago
    Good point. I’ll have to think it over a bit. Since I have all the info should be very easy to fix up the data. Just time consuming
- osteele 9y ago
  I used to do that but sometimes you have to read them over the phone. Now I use the “Words” recipe to generate a 2-3 word answer for each field. For example, if I had to fill out my answers right now, my high school would be “Popcorn Gizzard”, my childhood friend would be “Procure Drowse”, and my first car would be “Sextant Overflow”.
jkingsbery 9y ago
This article makes me appreciate that "what was the first programming language you learned?" isn't a common security question.
dfxm12 9y ago
Good security: Don't give away historic details about yourself. Better security: Do give away many different fake historic details about yourself.
DataWorker 9y ago
And don’t apply for any federal work. And don’t use credit cards. And...
trolliloquy 9y ago
I don't know if it is right to post this here, but how many of you relate this post to "Now You See Me" ? URL: https://www.youtube.com/watch?v=95jHwnAhHgU https://www.youtube.com/watch?v=95jHwnAhHgU This contains both scenes - how they steal the information and how they abused it.
Moodles 9y ago
I'm filling out a visa application form right now. I kid you not, I'm supposed to keep the username secret too. And then if you do a password recovery, they email you a new password (which is like 6 characters) WHICH YOU THEN CAN'T CHANGE (except if they email you another new one). It's a joke. I had to come up with a security question so I just make them sarcastic: "In what world is this secure?"
andrewflnr 9y ago
I can confirm that "first concert you went to" is a security question on at least one site.
znpy 9y ago
This is a bit paranoiac in my opinion, but I see the point. I mean, I cannot in all honesty say he is wrong. My approach to this problem is, given the fact that I use a password manager[1], the following: I chose a random question from the proposed set, and then generate a random password and use it as a "secret answer". Given the fact that 99% of the time the security question will be checked by a computer, the security question effectively becomes a secondary password. But as I write I am just realizing that the security question is probably not stored in a secure manner (salt + hash) anyway, so in the event of a data leak well that account is f*ed up anyway. Also, this has always seemed problematic to me: my secret question is supposed to be something I "just know" but... Let's assume the question is "what was your favorite teacher at elementary school" and my answer is "Mrs Chtulu"... What if I come back in a year and instinctively type "Miss Chtulu"? Do I have to remember the spelling I used? The capitalization? What if when I was 13 i did not bother capitalizing names and surnames properly but now I do ? -- [1] - if I happen to lose the password file, I'm probably in the middle of way bigger problems.
PeterStuer 9y ago
The 'secret questions' approach is also used by my bank to 'secure the line' when you call them to unblock your pin-attempts (the card blocks after 3 wrong guesses/mistypes) on your ATM card. These aren't questions that you had to fill before, but rather questions from their CRM like the address on which you first purchased fire-insurance with them etc. While the risk isn't great (it just gives you 3 more attempts), it still feels weird.
arikrak 9y ago
How often do websites just trust a security question for verification? I thought they usually ask it along with something else like along with a password reset email.

532 points by zeveb 9y ago

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions they use are often easily guessable (although it seems now they are using somewhat better questions). Nevertheless, my attitude is that I'll just make sure to retain the password. I get the possible security risk of answering quizzes on places like Facebook, but I've done it a few times because it's fun. It all boils down to passwords being a hassle. Almost anything you do to make dealing with passwords easier makes them less secure, but there's nothing better. The only improvements over passwords come from additional authentication factors, like having to grab a code messaged to your cell-phone, or using one of those little security token devices (or the software equivalent). I don't think anything is going to be replacing passwords any time soon.

wycy 9y ago
Typically using a secret question also requires you to have access to the email account you signed up with, so it's almost 2FA at that point.
downer61 9y ago
Hashing a salted string of "an answer" usually works. Phone operators try to ask you the question, though, and you sit there for five minutes reading off hundreds of characters, and everyone is suddenly having a bad day, which I find hilarious. The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me. The obvious corollary though, is that there really are organizations with systems that using publicly available information about, mixed with misinformation to see if you can discern an "accurate-ish" (which is sometimes not correct at all, even if you know what they think the correct answer is), and they don't even give you options about what public information they're going to select, to verify your identity. It's usually a brief questionnaire about previous addresses, associated last names, states you paid your taxes in, and it deeps the impression that there are simply gaping, flawed security gaps at the core of everyone's financial factoids, because it's also sourced from poorly conceived paper-based bureaucratic files that never had any hope of being accurate from the outset.
- ghfbjdhhv 9y ago
  >The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me. The person on the other end of the phone had nothing to do with it.
  - downer61 9y ago
    My hope is that the ambient animosity seeps through, via high turn-over, leading to increased personnel costs for the organization. In general, hopefully this uncooperative behavior adds to the general misery distributed throughout the world, and all just because security goons need to feel like they're smarter than the people subject to their policies. Consider this, oh reader, should you have the opportunity to alter password policies for a project your working on.
    - icebraining 9y ago
      Clearly you haven't done customer support, if you think having to listen to a long string of characters is what's going break them :)
  - jjeaff 9y ago
    For me, as an early stage startup, my devs are actually doing some customer service. I find it has helped our UI/UX immensly because they have to deal with all the problems directly. I actually think it is a great idea to let your developers spend at least a little bit of time each week (or day) doing customer service. It's amazing how much faster little bugs get fixed and processes get streamlined.
nmstoker 9y ago
Indeed, they're only slightly less stupid than considering SSNs to be secret and then using those. As others also suggest, I always make up the answers, different per counterparty - there's no way I fully trust places like my work to keep these details securely, so it's worth compartmentalizing the risk
thefifthsetpin 9y ago
I do the same. Once, a bank asked me over the phone what my high school mascot was (or whatever) to verify that I was really me. I hadn't expected them to use the question in this way, so I wasn't prepared to look up my answer. Knowing whatever randomly generated string I'd used was likely unpronounceable I answered, "I could teach you to pronounce it, but first you'd need to cut out your tongue." which they accepted.
- teamhappy 9y ago
  > which they accepted That's not great.
  - sbov 9y ago
    Yeah, this is why I use "lies" rather than "randomly generated string".
  - tajen 9y ago
    I confirm here. Another bank accepted for me.
- PebblesRox 9y ago
  This happened to me but I’d chosen the “write your own question” option, so the lady asked me “what is [childhood imaginary friend]’s middle name?” I told her the answer and she said “that was cute.” I never expected an actual person to ask me the question!
hw 9y ago
SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.
- pacala 9y ago
  Doesn’t 2fa mean password + phone? How is getting the phone sufficient?
  - shakna 9y ago
    You can often reset the password if you can intercept the chosen token generator, like SMS.
- jackhack 9y ago
  In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear. It's disgusting how twisted these criminal activities have become.
  - sitkack 9y ago
    I remember a reading about an activist that had all of their online accounts wiped by this vary mechanism. They had 2FA protecting everything, but someone called their cellular carrier and switched their account over to a new SIM. They then did password resets on all the accounts and wiped them. Every alternative way in is a larger attack area.
  - aaron_m04 9y ago
    How does the phone number get identified? You would think that'd be confidential.
simonw 9y ago
I agree, secret questions are dumb... but what are the alternatives? The majority of human beings now manage important parts of their lives online, which means they have to remember passwords. Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one. Secret questions may be revoltingly insecure, but they do at least let people get back into their accounts. We need to do better, but I don't know what "better" looks like.
- gnulinux 9y ago
  > Humans are TERRIBLE at remembering passwords This is the main problem and we created this problem. Over the last 30 years we worked so hard to make passwords weird and not even that hard for computers to try find. If your password is a sentence that you know by heart, say your favorite quote, the motto of your country, of your school, or some cool fact etc... your password would be (1) safer and (2) easier for you to remember. That's what I do and I never have hard time remembering my 4 to 6 word password. I just use bunch of books/movies and remember my favorite quotes. For example "one ring to rule them all" is a good password, or "may the force be with you" or "call me ishmael".
  - Simon_says 9y ago
    Are you kidding? Those are terrible passwords, and there’s already some script kiddie out there with a password list containing the top 10 billion book, music, tv show, and movie quotes. A good password has entropy, which is not a property of the alphanumeric string but of the process used to create it. Could your password generation method plausibly have produced 2^60 alternative passwords with equal probability? Probably not. Also, never reuse passwords.
    - dsfyu404ed 9y ago
      Are you kidding? Which is longer, the alphabet or the dictionary? There's a hell of a lot more words in any language than there are characters that make them up. N case insensitive words is far better than N character password from the normal set of characters (alphanumeric + special characters). Even if you restrict the combinations of words to grammatically correct sentences there's still more combinations than there are of for the same number of characters That still holds even if you make assumptions about sentence structure, common word combinations, etc, etc. There's a lot of words out there.
senorjazz 9y ago
I nearly lost my google account that way. I gave a nonsense answer totally unrelated to the question as I knew I would never forget my password. Was in a different country, got locked out, had to give my security question answer.... oh dear. After about 3 months occasionally sitting down and just trying out random things I meant have entered I managed to get it back.
- testplzignore 9y ago
  I've lost an account on another service this way. They did a forced password reset. To set a new password, you had to go through the forgot password flow, receive the email, and then answer the security questions. You would think that if the passwords were compromised, the (probably plain text) security questions were certainly compromised.
Jeremy1026 9y ago
When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she was baffled when I told her the question selected didn't matter, and the answer was a seemingly random alphanumeric string. I told her that I don't know her, or her machine. For now, I'll be setting it as quick, easy for me to remember, string and I'll change it to a different one when I get home.
- gnulinux 9y ago
  I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.
  - r00fus 9y ago
    So use passphrases that adhere to your security requirements (upper/lower/symbol etc)
  - jstarfish 9y ago
    > Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A METH-FUELED SWINGER PARTY IN A CHEAP MOTEL etc.
    - gnulinux 9y ago
      My problem with that is remembering and generating it. First problem is easy to solve with password managers but you still have to generate an ideally long car name with no bias. If you put some bias, then it might be backtracked. You can have a dictionary of possible car names but then you're open to attack if that dictionary is found or predictable enough that someone else can compile that list. It just doesn't feel secure enough to me.
smsm42 9y ago
The funny thing is the search space for most of these questions is so narrow. I mean, they ask for colors (how many are there? how many average person can name?), city names, personal names, baseball teams, school mascots, etc. How easy is it to compile a dictionary for all of those? Probably won't take more than a day. > I've always given false info to those, when I bother to fill them out at all Average person, not trained in using password managers, won't do it. In fact, most password managers don't support those, so you need secondary secure storage. Chances of a layperson setting up one properly and consistently using it is close to zero. > Nevertheless, my attitude is that I'll just make sure to retain the password. The problem is, on some sites, if you know these questions you can just reset the password. Which is insane, but unfortunately happens.
- QasimK 9y ago
  Honestly you need a better password manager if it doesn’t allow you to store arbitrary notes or secret question/answer pairs.
enobrev 9y ago
I agree with you and for accounts that matter (bank, etc), I'll generally generate additional passwords with my PW manager for each question and store them there. That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singular favorite things? How the hell should I know what my favorite movie was 3 years ago when I rushed through some account creation process on some random website?
- StavrosK 9y ago
  They stop making new movies when you answer that question, thus ensuring your answer will remain valid.
  - jstanley 9y ago
    That still doesn't stop you stumbling across an older film that you've never watched before, and then finding that you like it more than your "favourite".
    - StavrosK 9y ago
      Wait, you answer the question before having seen every single movie? How irresponsible.
      - lfowles 9y ago
        I tried my best but the session timed out before I had even finished one movie.
    - bigiain 9y ago
      Simple - we'll destroy every film in existence after you've asked that question. You get to be "the movie guy". That guy over there is "the book guy". The one in the corner who everybody hates? He's the one who had to use his first girlfriend's name...
- 9y ago
cmurf 9y ago
Exactly. But having to come up with fake answers to stupid questions and track them, is just proof of how bad some people are at their job. Apple still does this kind of crap. Actual questions: In what city did your parents meet? What is the first name of your best friend in high school? Recently an airport public WiFi in a major city in Europe wanted my birthdate and the agreement language said that I acknowledge everything I'm stating is true and correct. It's so blatantly asinine. I didn't even bother to look if it cited some EU law that lying is a crime, I just said fuck it, and went without Internet for a few hours.
- ryannielsen 9y ago
  Apple still does this kind of crap. Not for users who've opted into two-factor authentication: https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915 From the page: Do I still need to remember any security questions? No. With two-factor authentication, you don't need to choose or remember any security questions. Your identity is verified exclusively using your password and verification codes sent to your devices and trusted phone numbers. When you enroll in two-factor authentication, we will keep your old security questions on file for two weeks in case you need to return your account to its previous security settings. After that, they will be deleted.
- MzxgckZtNqX5i 9y ago
  One thing that really drives me crazy is that Apple asks me my security questions even if I enter my correct password because I haven't logged in for a while. I didn't saved the answers (and this is my fault) but anyway I would have done it in the KeePass database that contains also the password, so no additional security.
  - zepolen 9y ago
    They do that to remind you of the security answers. Still a broken model over all.
    - MzxgckZtNqX5i 9y ago
samstave 9y ago
I love the following technique: Question: What was the name of your first cat? A: cat Q: what city were you born in A: city Q: what is your moms maiden name? A: name and the like.
- FreeFull 9y ago
  Now that you shared it here though, someone might try this on you.
acchow 9y ago
Square Cash is passwordless. They move money around.
pieguy 9y ago
I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options! Sometimes my answer would not be shown and the correct answer is "none of the above", but otherwise my answer sticks out like a sore thumb.
- furyg3 9y ago
  This, too, was my problem. I don't want to give out real answers to my security question for two (slightly contradictory) reasons. The first is: what if this site is hacked? Now my security question answers are floating around for use on other sites that ask similar questions. The second is: some of these questions are pretty easy to find the answer to, or guess. So I used a generated string for those questions, too. Generally worked, but sometimes made for some interesting phone calls. "My mothers maiden name is <random string>. You can guess why she took my father's." Then they started reading back random choices, which made it pretty easy to guess what I picked.
  - derekp7 9y ago
    I have a third problem -- often times, the list of questions they ask are non-sense to me. "What is your favorite food?" I don't have a favorite, and can't think of anything that I'd remember later. "What was the name of your first pet?" I never had a pet. "What was the name of your high school sweetheart?" Gee, thanks a lot for stirring up bad memories.
    - Trundle 9y ago
      Here's a fourth that was actually responsible for me starting to just use generated passwords for those as well. They told me my answer wasn't valid. According to them, it's impossible for your mothers maiden name to have less than six characters :/
      - mighty_atomic_c 9y ago
harikb 9y ago
I have always wondered what happens if the receiving site is someone like IRS or any such government entity. If one of the questions was "where was your father/mother born?" and you gave a fake answer.. are you now "lying to the government"? There are lot of questions that can have provable right/wrong answers - assuming someone powerful is out to get you. Imagine that being used against someone!
- brewdad 9y ago
  I'm not even 100% sure where my mother was born. Her family moved around a lot back then (military) and her and each of her siblings were born in a different city. She passed away almost two decades ago, so it's not like it would ever come up now. I guess I could try to find her birth certificate somewhere in my dad's papers assuming he still/ever had a copy.
- mseebach 9y ago
  I don't think lying to the government is automatically illegal (ymmv, ianal, probably varies with jurisdiction). They are generally pretty explicit about the contexts in which lying is illegal (certain signed forms, being under oath etc) which would imply that lying is at least not illegal in other cases. This is not, by the way, a strictly government related concern. If you lie on a credit card application (and are caught), you're going to have a bad time. But the signed bit of the application is usually completely different from where you're asked to set up "security questions".
stronglikedan 9y ago
I know it may be to my detriment some day, but I just use the same answer for all secret questions everywhere. It has nothing to do with anything I've ever encountered, anywhere I've ever been, or anyone I've ever known. I do use a password manager, but my bank will ask secret questions to register new devices, so I've resorted to this tactic to reduce the hassle.
- Mikeorias 9y ago
  Let's hope you won't have to regret sharing this information too publicly...
blauditore 9y ago
Does Apple still do this? I always wondered how they're glorified for Privacy and Security while pulling this off...
frenchman_in_ny 9y ago
What's worse these days is, ever since the Equifax breach, certain institutions have taken to asking me for the last 6 digits of my social (or even worse... all of them...)
- sitkack 9y ago
  The last 4 or 6 are the ones with the most information. The preceding 3-5 digits are handed out in blocks to the states. So if you roughly know when and where someone is born, you can guess their prefix. http://www.ssofficelocation.com/social-security-number-prefix http://www.ssofficelocation.com/social-security-number-prefi...
- Retra 9y ago
  SSN isn't even a 'secret' number. Military folk have it on their ID tags and you're supposed to give it up if you're a POW. If you're supposed to give it to your enemies, then how is it private info?
zamalek 9y ago
I store my automatically generated secret answers in my password manager.
m0rganic 9y ago
The pupose of the “security question” is simple.. if a user needs to recover their password then the next best way to verify authenticity of the password reset request is to verify they know the answer to a few pieces of information they have previously shared with the service. In the age of mobile devices and 2FA, this becomes a lot less relevant but is still a very viable alternative because it’s accessible and difficult to crack if done right.
- m0rganic 9y ago
  also if answers to those questions alone has given you access to your account it is most certainly implemented poorly. Typically access to the account would come in a 2nd factor form like clicking on a reset password link from an email account that is yours and previously configured for such service. Only then would you be allowed to provide a new password to recover the account. Brute force protections like ensuring only a finite amount of failed attempts are necessary.

deleted 9y ago

[deleted]

gregmac 9y ago

Underlying this, don't ever answer these stupid 'account security' questions truthfully. Better to make something up and store it in your password manager along with other account info. I'd normally be tempted to put in the same types of random passwords I normally use, eg: > What was the name of the street you grew up on? L9Pro840Of9KNIGfKD4tf8tOwTG9Dcqj Unfortunately, I've heard you can talk to customer support and say things like "I think I just typed in random garbage for that" and they'll accept it. Whether an attacker would know or try this I'm not sure, but I could also see a customer rep hinting towards this when they see it. It's probably better to actually make up something plausble-sounding but incorrect, like "Summit Avenue". (Related: there's a website for this [1]) [1] https://www.randomlists.com/random-street-names https://www.randomlists.com/random-street-names

fenwick67 9y ago
A heuristic where you transform a truthful answer might be better. i.e. your first car was a Bronco, security answer = hash('bronco'+secret).slice(6)
- coldacid 9y ago
  The problem with that is that it goes back to being gobbledygook for which the operator will accept "I just smashed the keyboard for it".
- jjeaff 9y ago
  My issue is that most of the time, the available questions are just frustratingly dumb. I don't have a favorite song, favorite movie, or favorite food. I like lots of things and those things change over time. And seriously, favorite teacher? That's very common. How many people really have a favorite teacher.
jetrink 9y ago
Another option is an XKCD-inspired[1] 'correct horse battery staple' passphrase. I understand that using such passphrases in other contexts like encryption is controversial due to their relatively low entropy, but I think customer support is an ideal application for them. 1. https://xkcd.com/936/ https://xkcd.com/936/

abhiminator 9y ago

A good idea to counteract privacy risks of this sort is to occasionally search yourself by your full name or by username (one that can be traced back to you, that is) across all major search engines and see if any of your data is out in the open in any public forum. Same goes for searching your phone numbers, physical addresses and your email address (preferably in double-quotes for an exact match) -- I discovered mine stashed in a blog full of random email address in which my ID was a part of -- reported it to Google and it was gone in a couple of days. I perform this 'exercise in privacy' once every three months -- which for me is the average time in which I sign-up for a new service or product using my primary email address; YMMV. A related article for those who're interested (shameless plug) -- https://abhishekbalaji.wordpress.com/2016/09/24/why-you-should-occasionally-google-yourself/ https://abhishekbalaji.wordpress.com/2016/09/24/why-you-shou...

yuriyb 9y ago
Google provides a way to "subscribe" to email notifications of new search results for a given term (don't have the link handy right now). I've been subscribed to results for my full name for many years, and occasionally get an email of a new mention here and there.
- abhiminator 9y ago
  I think you're referring to Google search alerts[0]. I agree, that's a pretty neat tool to be subscribed to, should be useful in drastically cutting down the response time when responding to instances of one's personally identifiable data leaking on the web. [0] https://support.google.com/websearch/answer/4815696 https://support.google.com/websearch/answer/4815696
shostack 9y ago
What was the mechanism by which you reported it?
- abhiminator 9y ago
  I reported the blog that was hosting the violating content, not the particular search result in question. My apologies, should have made that clear in my earlier response.

lucb1e 9y ago

So let's get rid of security questions and we can just carry on? There should be no harm in disclosing information which is already known by dozens of people, like your mother's maiden name or your first pet. Going around and telling everyone "keep your history concealed!" is just silly and will get you the tinfoil hat label, making any future security advice useless. I typically agree with him but this just seems like attacking the wrong problem.

asfgionio 9y ago
I am not entirely sure I agree. Maybe it's slightly paranoid, but I find it shocking how much information people share on the Internet. I still abide by the old idea that you never share personal information on the Internet.

yuriyb 9y ago

I've never provided literal, logical answers to security questions, as even without sharing the answers elsewhere, the logical ones would be entirely too easy to guess. "Make of first car?" There are only so many vehicle brands reasonably accessible in a geographical area - not hard to brute force. "City of birth?" Common knowledge among all my friends. It's too easy. An appropriate answer to "Make of first car?" would be something like "red &5 Blueberry."

saalweachter 9y ago
So it's a common trope in science fiction that super-intelligences will resurrect historical people using DNA and mumble-mumble to get their memories. We finally have a plausible answer to how computers a thousand years from now will be able to reconstruct the details of your life: security questions.

HugoDaniel 9y ago

I was born in 1900/1/1

pbhjpbhj 9y ago
You must like scrolling, I was born in 19__/1/1 where the missing digits put less wear on my mouse wheel.

benpiper 9y ago

Don't give out your birthday either.

quantumfoam 9y ago

I usually just do a random hash. Also, really, really hate the sites that do not allow you free form text the question itself and rather populate a bunch of commonly known ones. FFS, if you're a web developer working on security questions, let the user make up the question. Agreed though, we should just do away with this as an authentication factor.

PebblesRox 9y ago
Let the user make up a question and remind them that they might need to answer it over the phone so they don’t choose something embarrassingly personal.

United857 9y ago

United Airlines is probably one of the worst I've seen: http://www.slate.com/articles/technology/future_tense/2016/03/united_airlines_uses_multiple_choice_security_questions.html http://www.slate.com/articles/technology/future_tense/2016/0... Not even free text but only allowing a limited set of answers via dropdown menus (most of the provided answers don't apply to me either, so it's both insecure for them and hard for me to remember as well)

et-al 9y ago
I tweeted at them about this when those dropdown answers came out and they actually responded to me, but never took action to change things. The official United response on FlyerTalk (linked from the Slate article) is naïve to say the least: > We purposely chose to use preregistered answers as our first form of enhanced authentication to protect against this keystroke logging. We need to ensure that all of our customers have a high degree of security and our research also indicated that some customers had self-entered security answers that would be very easy to guess. Wow. Source: https://www.flyertalk.com/forum/26212495-post233.html https://www.flyertalk.com/forum/26212495-post233.html

pwinnski 9y ago

Using random characters for answers to "secret questions" only works when you can be 100% sure you will never have to give the answers over the phone. If you ever have to do that, random characters are worse than reality, because phone reps will just say, yeah, you're right, it's gobbledygook. I give arbitrary answers that would make sense to something like an AI. Like, "Q: Who was your father's first employer? A: Avocado flesh" or "Q: What is your mother's maiden name? A: Rutherford B. Hayes" Of course, all such answers are stored in my password manager.

ourmandave 9y ago

Stealing one account at a time is small time hoodlum level sh*t. The pros just download the entire user table in one go. They don't care what your first pet's name was.

Simon_says 9y ago
Unless you’re famous or wealthy. Has happened numerous times.
PrimHelios 9y ago
It doesn't matter if the person after your account is a skid, or is a government-backed entity, you lose all your data and online accounts either way.

Reedx 9y ago

I don't know which annoys me more, the easy to guess security questions or those with mutable answers. Things like: What's your favorite vacation spot? What's your favorite food? Often you're stuck having to choose between something other people know or can figure out (where you were born) and something that may well change over time.

saalweachter 9y ago
I like the idea of trolling people with security questions that you never actually use in a password-recovery workflow. What is your third favorite vacation spot? Would you rather fight a horse-sized duck or 100 duck-sized horses? For how much money would you go to jail for 1 year?
- jgroszko 9y ago
  I was always a fan of these nihilist security questions: https://www.mcsweeneys.net/articles/nihilistic-password-security-questions https://www.mcsweeneys.net/articles/nihilistic-password-secu...
  - et-al 9y ago
    The New Yorker published a cartoon along that vein last year with "Insecurity Questions": https://www.newyorker.com/humor/daily-shouts/insecurity-questions https://www.newyorker.com/humor/daily-shouts/insecurity-ques...
- bdefore 9y ago
  I've just chuckled for far too long visualizing your horses and your ducks. Now everyone here at this cafe thinks I'm some kind of animal murderer.

makecheck 9y ago

The thing they never get right is that the answer to a question is only useful if you can write the entire question. You should never be forced to select a question from a list. Also, I can’t believe how stupid some of these sites’ questions are. While I always make up the answers, frequently they require at least 3 questions and only 1 or 2 even apply to me (assuming I answered truthfully)! And one airline wanted FIVE of them!!!

cheschire 9y ago

I've been really concerned about how freely people seem to give their DNA away to testing services like 23andMe or Ancestry DNA. I just get this feeling that in the next few decades genetic code may become the pinnacle of biometrics as a part of multi-factor authentication. i.e. something I know, something I have, and something I am. And DNA databases that are potentially loosely secured, or at least secured as well as credit bureau's data, seem like a great way to unwittingly expose one's future self. I bring this up because multi-factor authentication still seems to be a struggle to implement well for the masses, and while people here complain about these personal questions being insecure, I can't really think of a reason why genetic code won't become the ubiquitous standard for the vast majority of the population to prove their identity. Yet here people are giving it away, and even paying for the privilege.

nanomonkey 9y ago
DNA can be harvested from dead hair, skin or spit even, so anyone with access to your physical environment could obtain your DNA.
- cheschire 9y ago
  Yeah, I was considering more along the lines of massive compromising of remote authentication mechanisms, not spycraft targeting.
  - beenBoutIT 9y ago
    LMFAO.
- logfromblammo 9y ago
  It should really be considered public information. You leave your DNA everywhere you go. Like all biometrics, the most it should be used for is identification, never authentication. You're still going to need a secret, and maybe also a token.
  - deleted 9y ago

8bitsrule 9y ago

The first thing to think, when a website (or stranger on the street) asks you an out-of-the-blue personal question is: why is s/he asking? Cuz it's probably not because they give a crap.

mindslight 9y ago

What is with perpetuating this idea that people have some duty to be responsible for companies' broken security practices? You're unable to prevent their fuckups - so you can only take steps to make sure you don't end up on the hook or otherwise severely impacted due to their negligence. It's not my job to avoid repeating public information like mother's maiden name, historical addresses, etc. Nor is it my job to worry about whether a bank will bypass confirming "secret question" strings for anyone stating they're just random letters. As an non-responsible third party to any possible identity-based fraud, the only thing I see the need/ability to do to protect myself is watch transactions on my accounts (automation helps here, eg OFX), and be prepared to send demand letters/sue the surveillance companies for libel if they start spouting off that "I" opened accounts that I did not. Feeling any more responsible than this is just helping to continue their negligent/lazy/broken-ass business processes.

philwelch 9y ago
I don't really see "responsibility" as a useful lens. If you give away information that can be used to reset your passwords, you make it more likely that someone can reset your passwords. Assigning blame is something people do to make themselves feel better after bad things happen. Making it less likely for bad things to happen in the first place may or may not be worth the time and effort, but whether or not you're morally responsible is a pretty meaningless question.
- mindslight 9y ago
  > Assigning blame is something people do to make themselves feel better after bad things happen Eh, not really. Assigning responsibility is how we align incentives to prevent things from happening in the first place. You are responsible for not disclosing your bank password. You are not responsible for repeating public information that a bank foolishly decided to consider an authentication token. Personally fretting about whatever broken actions a bank decides to take uses up a disproportionate amount of your time, as you're unable to actually change them. And any success just encourages the bank to continue, as they suffer less from their own idiocy.

EGreg 9y ago

I think you have it backwards, here. Instead of urging people to NOT reveal details about their life such as their first pet’s name, you should urge them to answer all password reset questions with at the very least irrelevant answers, or a password reset password.

rdiddly 9y ago

That's why the answers to the security questions are always random strings, and the answers to the quiz questions are always "your mother." e.g. I learned to drive stick-shift on your mother. My first pet was your mother. My special furry friend is your mother. And so forth.

hateful 9y ago

I was born in the US, raised on TV and now I reside on the Internets.

zzm 9y ago

As others in this thread have stated, security questions are less secure than using a password, and thus, a poor way backup to passwords. One interesting alternative that's been presented recently is Mooney Images [1]. The example images in the linked slides are fun to test out on yourself and others. They rely on a user's implicit memory of visual imagery and while they are also susceptible to similar sorts of side-channel inquiries, they would be much more obvious. [1] https://www.mobsec.rub.de/media/mobsec/veroeffentlichungen/2017/03/08/MooneyAuth-NDSS-2017.pdf https://www.mobsec.rub.de/media/mobsec/veroeffentlichungen/2...

rabboRubble 9y ago

I use 1Password as a password vault. Some years ago, I decided to start lying for secret question answer challenges. I use 1Password to generate a string of garbage (without numbers or symbols, 25 characters long) and keep that answer in a custom field in the 1Password vault. I've tagged those entries with a security tag to find all accounts with secret Q&A information. I am paranoid about back ups because if god forbid I lost that vault, there are accounts that would be permanently lost to me.

itakedrugs 9y ago
One problem with this is social engineering... someone could call the company to recover their password and say that they entered garbage for the security question... I started to enter passphrases instead
- rabboRubble 9y ago
  Good point. I’ll have to think it over a bit. Since I have all the info should be very easy to fix up the data. Just time consuming
osteele 9y ago
I used to do that but sometimes you have to read them over the phone. Now I use the “Words” recipe to generate a 2-3 word answer for each field. For example, if I had to fill out my answers right now, my high school would be “Popcorn Gizzard”, my childhood friend would be “Procure Drowse”, and my first car would be “Sextant Overflow”.

jkingsbery 9y ago

This article makes me appreciate that "what was the first programming language you learned?" isn't a common security question.

dfxm12 9y ago

Good security: Don't give away historic details about yourself. Better security: Do give away many different fake historic details about yourself.

DataWorker 9y ago

And don’t apply for any federal work. And don’t use credit cards. And...

trolliloquy 9y ago

I don't know if it is right to post this here, but how many of you relate this post to "Now You See Me" ? URL: https://www.youtube.com/watch?v=95jHwnAhHgU https://www.youtube.com/watch?v=95jHwnAhHgU This contains both scenes - how they steal the information and how they abused it.

Moodles 9y ago

I'm filling out a visa application form right now. I kid you not, I'm supposed to keep the username secret too. And then if you do a password recovery, they email you a new password (which is like 6 characters) WHICH YOU THEN CAN'T CHANGE (except if they email you another new one). It's a joke. I had to come up with a security question so I just make them sarcastic: "In what world is this secure?"

andrewflnr 9y ago

I can confirm that "first concert you went to" is a security question on at least one site.

znpy 9y ago

This is a bit paranoiac in my opinion, but I see the point. I mean, I cannot in all honesty say he is wrong. My approach to this problem is, given the fact that I use a password manager[1], the following: I chose a random question from the proposed set, and then generate a random password and use it as a "secret answer". Given the fact that 99% of the time the security question will be checked by a computer, the security question effectively becomes a secondary password. But as I write I am just realizing that the security question is probably not stored in a secure manner (salt + hash) anyway, so in the event of a data leak well that account is f*ed up anyway. Also, this has always seemed problematic to me: my secret question is supposed to be something I "just know" but... Let's assume the question is "what was your favorite teacher at elementary school" and my answer is "Mrs Chtulu"... What if I come back in a year and instinctively type "Miss Chtulu"? Do I have to remember the spelling I used? The capitalization? What if when I was 13 i did not bother capitalizing names and surnames properly but now I do ? -- [1] - if I happen to lose the password file, I'm probably in the middle of way bigger problems.

PeterStuer 9y ago

The 'secret questions' approach is also used by my bank to 'secure the line' when you call them to unblock your pin-attempts (the card blocks after 3 wrong guesses/mistypes) on your ATM card. These aren't questions that you had to fill before, but rather questions from their CRM like the address on which you first purchased fire-insurance with them etc. While the risk isn't great (it just gives you 3 more attempts), it still feels weird.

arikrak 9y ago

How often do websites just trust a security question for verification? I thought they usually ask it along with something else like along with a password reset email.