4 ms·

When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she

When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she was baffled when I told her the question selected didn't matter, and the answer was a seemingly random alphanumeric string. I told her that I don't know her, or her machine. For now, I'll be setting it as quick, easy for me to remember, string and I'll change it to a different one when I get home.

gnulinux 9y ago
I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.
- r00fus 9y ago
  So use passphrases that adhere to your security requirements (upper/lower/symbol etc)
- jstarfish 9y ago
  > Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A METH-FUELED SWINGER PARTY IN A CHEAP MOTEL etc.
  - gnulinux 9y ago
    My problem with that is remembering and generating it. First problem is easy to solve with password managers but you still have to generate an ideally long car name with no bias. If you put some bias, then it might be backtracked. You can have a dictionary of possible car names but then you're open to attack if that dictionary is found or predictable enough that someone else can compile that list. It just doesn't feel secure enough to me.
    - Dylan16807 9y ago
      A security question doesn't need to have a huge amount of entropy. It's probably not hashed in the first place, so computerized brute forcing isn't a worry. It just needs to stand up against a limited number of fake logins or password reset attempts.
    - aaron_m04 9y ago
      What about those programs that generate a Markov model out of a corpus of text? You could use that to generate the answers (provided the randomness source is secure).
  - deleted 9y ago
    [deleted]
  - vinceguidry 9y ago
    To be fair, to actually exploit this the scammers would have to know you put in a random string. A human customer service process is not really subject to dictionary attacks.
    - cortesoft 9y ago
      Except customer service is often trying to help you remember, and you can guess a few times.... a scammer will say something like, "Oh man, I can't remember what I picked... sometimes I choose a random car model, but sometimes I just put random characters", and if either is true, the customer service rep might confirm it.
      - stordoff 9y ago
        Incidentally, I've also had customer service go the other way. I was doing a security check, and one of the questions was how long have you lived at your current address. We moved when I was about 10, so I said "I think it's XX years, let me double check: Mum, how long have we lived here, is it XX or XX+1 years?", only to get "It has to be YOUR answers". Despite knowing all the other relevant answers (random characters of password, memorable name and date, amount of last Direct Debit, down to the pence, first line of address and post code) first time and without prompting, it ended up with my account being locked. Definitely more security, but _maybe_ slightly too far in the other direction.
- hnaccy 9y ago
  You could have predefined mappings of characters to strings so that they appear non-random, e.g. SBNLWPXMZ -> Seattle Boston Newcastle Lagos Washington Paramaribo Xanadu Montreal Zagreb.
  - roywiggins 9y ago
    Diceware? http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
- pbhjpbhj 9y ago
  Mistakes happen, people miss-key, database entries get put in the wrong field, ... I imagine that if the entry didn't match the format for the field then you're open to the bank clerk being socially engineered more easily. It's like if a password field said 'no punctuation, maximum 8 characters' and your password was much longer with lots of characters; particularly if it looks random it could appear to be a corruption. I imagine the range of given names gives most password entropy, so "family pet" might be the best question to choose, especially if you never had a family pet.
- stordoff 9y ago
  For that reason I basically use a fake identity for security questions - all perfectly plausible answers, but actually have nothing to do with me. It's not as secure, because they are shared, but it at least removes the ability to research the answers. I also just avoid setting them where ever possible -- it's basically only for banks (some random website isn't going to get real answers to security questions).

gnulinux 9y ago

I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

r00fus 9y ago
So use passphrases that adhere to your security requirements (upper/lower/symbol etc)
jstarfish 9y ago
> Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A METH-FUELED SWINGER PARTY IN A CHEAP MOTEL etc.
- gnulinux 9y ago
  My problem with that is remembering and generating it. First problem is easy to solve with password managers but you still have to generate an ideally long car name with no bias. If you put some bias, then it might be backtracked. You can have a dictionary of possible car names but then you're open to attack if that dictionary is found or predictable enough that someone else can compile that list. It just doesn't feel secure enough to me.
  - Dylan16807 9y ago
    A security question doesn't need to have a huge amount of entropy. It's probably not hashed in the first place, so computerized brute forcing isn't a worry. It just needs to stand up against a limited number of fake logins or password reset attempts.
  - aaron_m04 9y ago
    What about those programs that generate a Markov model out of a corpus of text? You could use that to generate the answers (provided the randomness source is secure).
- deleted 9y ago
  [deleted]
- vinceguidry 9y ago
  To be fair, to actually exploit this the scammers would have to know you put in a random string. A human customer service process is not really subject to dictionary attacks.
  - cortesoft 9y ago
    Except customer service is often trying to help you remember, and you can guess a few times.... a scammer will say something like, "Oh man, I can't remember what I picked... sometimes I choose a random car model, but sometimes I just put random characters", and if either is true, the customer service rep might confirm it.
    - stordoff 9y ago
      Incidentally, I've also had customer service go the other way. I was doing a security check, and one of the questions was how long have you lived at your current address. We moved when I was about 10, so I said "I think it's XX years, let me double check: Mum, how long have we lived here, is it XX or XX+1 years?", only to get "It has to be YOUR answers". Despite knowing all the other relevant answers (random characters of password, memorable name and date, amount of last Direct Debit, down to the pence, first line of address and post code) first time and without prompting, it ended up with my account being locked. Definitely more security, but _maybe_ slightly too far in the other direction.
hnaccy 9y ago
You could have predefined mappings of characters to strings so that they appear non-random, e.g. SBNLWPXMZ -> Seattle Boston Newcastle Lagos Washington Paramaribo Xanadu Montreal Zagreb.
- roywiggins 9y ago
  Diceware? http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
pbhjpbhj 9y ago
Mistakes happen, people miss-key, database entries get put in the wrong field, ... I imagine that if the entry didn't match the format for the field then you're open to the bank clerk being socially engineered more easily. It's like if a password field said 'no punctuation, maximum 8 characters' and your password was much longer with lots of characters; particularly if it looks random it could appear to be a corruption. I imagine the range of given names gives most password entropy, so "family pet" might be the best question to choose, especially if you never had a family pet.
stordoff 9y ago
For that reason I basically use a fake identity for security questions - all perfectly plausible answers, but actually have nothing to do with me. It's not as secure, because they are shared, but it at least removes the ability to research the answers. I also just avoid setting them where ever possible -- it's basically only for banks (some random website isn't going to get real answers to security questions).