6 ms·
This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can
by bargl 8y ago
This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that.
I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name of the babysitter with curly finger nails. I remember that and no one can figure it out based on the internet.
- dhimes 8y agoBut you can give that answer to any question they ask. That's what fake answers are all about.
- munk-a 8y agoIt depends, in the cases that they ask you for the answer you have control, but sometimes security question like things will just end up being personal data queries like "To what address did we send account statements in June of 2016" and if a bank (or whatever) asks questions like that to confirm identity over the phone there's no way you can compel them to do otherwise, short of taking your business elsewhere. Techniques like asking them to add a note to your account or flag it as locked... those only work if the CS people read and obey them, often times social engineering attempts will re-dail CS lines until they find someone who is tired or generally sloppy and get them to push the change through.
- ppeetteerr 8y agoThe hackers stole session tokens. It's not about passwords and security (well it is, but not on the user level), it's about better securing access to certain data.
- nathanaldensr 8y agoI use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.
- hermanradtke 8y agoPeople are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even worse I have had a customer service rep look at it, laugh and say never mind. I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.
- nathanaldensr 8y agoGood point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "Favorite food: Manchester").
- ryandrake 8y agoI used to use real answers but then wised up and switched to random 16-character responses. I wish there was a way to find out which services I’m vulnerable on due to my stupidly using real data, without attempting to do a password reset on all of my online accounts.
- JumpCrisscross 8y ago> wised up and switched to random 16-character responses As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too. [1] https://news.ycombinator.com/item?id=18203907 https://news.ycombinator.com/item?id=18203907
- ryandrake 8y agoI’d love to know which businesses have such an asinine policy. Name and shame! They are basically allowing a password reset with zero authentication.
- Kenji 8y agoI use random strings of length 32 for every security question. So it's like Q: What's the name of your first pet? A: pVp5TxN7htNC3B3Tae3RaPLndpLj5LeV
- keehun 8y agoIn my password manager, I save nonsensical answers (not a string of random characters) to built-in questions.
- dgacmu 8y agoWait, wait, was your high school mascot the leprous gummywormbat too?
- m-p-3 8y agoSecurity questions are IMO an awful form of account recovery, as they often use publicly available data about yourself. It's basically downgrading the security of the account more often than not. If there are no custom security question, I use my password manager to store them and put random answers not tied to myself personally.
- sharcerer 8y agoPSA: Woah.wait. I just thought since personal data of about ~30 million people was leaked, most of them would be having Gmail accounts. So, isn't Gmail under threat too? I think GOOGLE should also issue an advisory asking people to change their security questions. Did I miss something?
- deleted 8y ago[deleted]
- lostlogin 8y agoAs a kid with a newspaper round I set up a bank account and didn’t know what it meant when I was asked for my mother’s maiden name, so made up an answer. Accidental security. It is a hard problem.
- Mc_Big_G 8y agoOr just don't use facebook.
- Silhouette 8y agoFixed security questions just seem like a flawed idea anyway. When creating an account to access a significant financial service online recently, I was given a list of some 20 security questions and asked to choose 3. The problem was that 18 of them didn't apply to me or had no clear answer of the kind that I would certainly remember in the event that those questions were actually needed to prove my identity. These things are probably second only to using SMS-based 2FA for annoying security measures of questionable effectiveness being mandated by ever more services (though the new voiceprint-based 2FA is closing fast).
- DoreenMichele 8y agoIt's possibly even worse than that. I read a comment on HN that they decided to use a random word like "banana" as the answer to a security question like "What's your mother's maiden name?" Within a couple of days, the bank called his house and spoke with a different relative to get the real answer.
- Buge 8y agoHow is this relevant? Hackers can steal recovery question answers regardless of whether web token vulnerabilities exist. And web token vulnerabilities can exist regardless of recovery question strategies.
- WA 8y agoWhat? No! Custom security questions result in stuff like: “Am I blonde?” “What’s my shoe size?” “How old am I?” “Do I have a dog?” And of course, the answers to those are incredibly easy to guess / enumerate.
- nialv7 8y agoSecurity questions are DUMB. They are the exactly same authentication mechanism as password (i.e. proving you know some piece of information). So you basically have multiple backup password in case you forgot the first one. But worse. If you create a different password for them. Because you rarely use those answer, you won't be able to remember them when they are actually needed. If you generate them with your password manager, then when you loss your password you loss them too. If you actually answer the questions with real information, you basically created a weak password. All in all, security questions is a terrible idea.