5 ms·

I always answer the security questions with gibberish that I also save with my password manager. I now use a method like correct-horse-battery-staple to create

I always answer the security questions with gibberish that I also save with my password manager. I now use a method like correct-horse-battery-staple to create answers, but I used to use long alphanumeric strings. I switched methods because, yes, one day I had to read the answer over the phone. Rep: "Tell me the answer to this question." Me: "Ok, let me see what I set it to..." Answer: F^O9dA66@wUPpK5$lTXBbrQ#yLP1EGl$ Me: "Oh... Oh no."

ceejayoz 8y ago
I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. Lately, I've been making up a seemingly correct, but random response (and different each time). My favorite vegetable? Sea cucumber! I store that in my password manager.
- thaumasiotes 8y ago
  > I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. I can confirm that this is the case. I provided a gibberish answer to a security question for Blizzard. I didn't bother to write it down, relying on not forgetting my password. I never forgot my password, but Blizzard shut down my account anyway because I was making payments with a card that was not listed as the account's "primary payment method". (The card I was using was listed on the account, but another card was the "primary payment method".) When I had to call support and answer my security question, the answer I'd filled in just meant that I wasn't required to provide the correct answer.
  - zifnab06 8y ago
    I've found it's better to give them correct answers that are entirely fake. The make of your first car is an astin Martin. Your nearest sibling lives in lunar colony 1. This way "it's a bunch of gibberish" doesn't get past their security.
- metafunctor 8y ago
  I use something like this: “the secret password is tango-seven-alpha-romeo-zero-zero-victor-sierra-foxtrot-quebec". Never had to use these for real yet, but it should be a bit harder to be seen as a “a bunch of gibberish”.
  - ceejayoz 8y ago
    "Oh shoot, it was a bunch of random words. I'm so sorry, I had it written down but I can't find the paper..." Remember, an attacker can call support hundreds of times, getting a different rep every time. There's a good chance it'll work eventually.
    - metafunctor 8y ago
      Seems to me like that’s not really a criticism against using random answers for secret questions.
      - ceejayoz 8y ago
        Clearly random answers are a problem. You're going to find support reps inclined to accept "oh it's just something random", which means you're guaranteed get compromised if you're a big enough target to spend some hours on. Random but outwardly appearing valid ones are fine (but you'd want to avoid using the same answer on different sites). One site's "first car" could be Porsche 911, another's Aston Martin. Both aren't true, but the support rep doesn't know that.
hfdgiutdryg 8y ago
I do the same thing, but I only use strings that are maybe four or five characters of letters only. Most of these answers are expected to be things like people and street names, so I think it's still vastly more secure without looking like the system had an internal error.
dwyerm 8y ago
I use GPW strings for this use-case. GPW has weaknesses that make them somewhat poor for use as first-line passwords, but they're still really good for passwords that you need to read to someone over the phone. In my most recent experience with them, the company allowed to be set both the question AND the answer. So, they had to read a random string to me, and I had to read one back. It went quite well, actually. https://multicians.org/thvv/gpw-js.html https://multicians.org/thvv/gpw-js.html
zwayhowder 8y ago
The only change I make to this process is my security questions are stored in a separate password manager to my passwords. That way if I lose access to my passwords and actually need the stupid (ahem, security) questions I can find them.
AdmiralAsshat 8y ago
I've had the same situation before, and I don't think I've ever had to read them the entire thing. Usually we did something like this: Rep: "Tell me the answer to this question." Me: "Ok, let's see.....ah. So, it looks like a random string of gibberish, right?" Rep: "Um, well...(unsure if he's allowed to say Yes or No)" Me: "Yeah, I use a password manager for all my stuff, so all my passwords are randomly generated. I didn't think I'd ever have to read it over the phone. Sorry about that! I can read it out for you, but it might take awhile. If I read you the first three characters and the last three characters, is that sufficient to demonstrate for you that I know the Answer? Rep: "Yes, I think that would be fine." Me: "Alright, then! First three, 'F', 'caret', 'capital O'. Last three, 'capital G', 'lowercase l', 'dollar sign'. --- As I said, I've never had anyone challenge me to read the full thing out. When I explain why it is that way and give them the bookends, they are usually convinced that I'm me.
- aaronmdjones 8y ago
  As is demonstrated time and time again, the weakest point in any security system is usually a human being.
  - user5994461 8y ago
    If the operator gives up after the 10th random character given on the phone, it's still quite secure.
- btilly 8y ago
  I am reminded of https://xkcd.com/1181/ https://xkcd.com/1181/. What garbage string is there doesn't matter. Just as long as it is recognizably garbage and you know it.
- austhrow743 8y ago
  Theres a security issue there in that you don't want them in "I think that would be fine" territory. Some of those reps may have been fine with you saying "oh no. I didn't think I'd ever need that and just mashed the keyboard". Better to use something that's still made up, but is plausibly true.
coastal-fiesta 8y ago
This is exactly what I do. Keep it easily human readable but it should still be nonsense that no one could social-engineer their way into getting.

ceejayoz 8y ago

I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. Lately, I've been making up a seemingly correct, but random response (and different each time). My favorite vegetable? Sea cucumber! I store that in my password manager.

thaumasiotes 8y ago
> I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. I can confirm that this is the case. I provided a gibberish answer to a security question for Blizzard. I didn't bother to write it down, relying on not forgetting my password. I never forgot my password, but Blizzard shut down my account anyway because I was making payments with a card that was not listed as the account's "primary payment method". (The card I was using was listed on the account, but another card was the "primary payment method".) When I had to call support and answer my security question, the answer I'd filled in just meant that I wasn't required to provide the correct answer.
- zifnab06 8y ago
  I've found it's better to give them correct answers that are entirely fake. The make of your first car is an astin Martin. Your nearest sibling lives in lunar colony 1. This way "it's a bunch of gibberish" doesn't get past their security.
metafunctor 8y ago
I use something like this: “the secret password is tango-seven-alpha-romeo-zero-zero-victor-sierra-foxtrot-quebec". Never had to use these for real yet, but it should be a bit harder to be seen as a “a bunch of gibberish”.
- ceejayoz 8y ago
  "Oh shoot, it was a bunch of random words. I'm so sorry, I had it written down but I can't find the paper..." Remember, an attacker can call support hundreds of times, getting a different rep every time. There's a good chance it'll work eventually.
  - metafunctor 8y ago
    Seems to me like that’s not really a criticism against using random answers for secret questions.
    - ceejayoz 8y ago
      Clearly random answers are a problem. You're going to find support reps inclined to accept "oh it's just something random", which means you're guaranteed get compromised if you're a big enough target to spend some hours on. Random but outwardly appearing valid ones are fine (but you'd want to avoid using the same answer on different sites). One site's "first car" could be Porsche 911, another's Aston Martin. Both aren't true, but the support rep doesn't know that.

hfdgiutdryg 8y ago

I do the same thing, but I only use strings that are maybe four or five characters of letters only. Most of these answers are expected to be things like people and street names, so I think it's still vastly more secure without looking like the system had an internal error.

dwyerm 8y ago

I use GPW strings for this use-case. GPW has weaknesses that make them somewhat poor for use as first-line passwords, but they're still really good for passwords that you need to read to someone over the phone. In my most recent experience with them, the company allowed to be set both the question AND the answer. So, they had to read a random string to me, and I had to read one back. It went quite well, actually. https://multicians.org/thvv/gpw-js.html https://multicians.org/thvv/gpw-js.html

zwayhowder 8y ago

The only change I make to this process is my security questions are stored in a separate password manager to my passwords. That way if I lose access to my passwords and actually need the stupid (ahem, security) questions I can find them.

AdmiralAsshat 8y ago

I've had the same situation before, and I don't think I've ever had to read them the entire thing. Usually we did something like this: Rep: "Tell me the answer to this question." Me: "Ok, let's see.....ah. So, it looks like a random string of gibberish, right?" Rep: "Um, well...(unsure if he's allowed to say Yes or No)" Me: "Yeah, I use a password manager for all my stuff, so all my passwords are randomly generated. I didn't think I'd ever have to read it over the phone. Sorry about that! I can read it out for you, but it might take awhile. If I read you the first three characters and the last three characters, is that sufficient to demonstrate for you that I know the Answer? Rep: "Yes, I think that would be fine." Me: "Alright, then! First three, 'F', 'caret', 'capital O'. Last three, 'capital G', 'lowercase l', 'dollar sign'. --- As I said, I've never had anyone challenge me to read the full thing out. When I explain why it is that way and give them the bookends, they are usually convinced that I'm me.

aaronmdjones 8y ago
As is demonstrated time and time again, the weakest point in any security system is usually a human being.
- user5994461 8y ago
  If the operator gives up after the 10th random character given on the phone, it's still quite secure.
btilly 8y ago
I am reminded of https://xkcd.com/1181/ https://xkcd.com/1181/. What garbage string is there doesn't matter. Just as long as it is recognizably garbage and you know it.
austhrow743 8y ago
Theres a security issue there in that you don't want them in "I think that would be fine" territory. Some of those reps may have been fine with you saying "oh no. I didn't think I'd ever need that and just mashed the keyboard". Better to use something that's still made up, but is plausibly true.

coastal-fiesta 8y ago

This is exactly what I do. Keep it easily human readable but it should still be nonsense that no one could social-engineer their way into getting.