7 ms·
People are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even
by hermanradtke 8y ago
People are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even worse I have had a customer service rep look at it, laugh and say never mind.
I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.
- nathanaldensr 8y agoGood point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "Favorite food: Manchester").
- ryandrake 8y agoI used to use real answers but then wised up and switched to random 16-character responses. I wish there was a way to find out which services I’m vulnerable on due to my stupidly using real data, without attempting to do a password reset on all of my online accounts.
- JumpCrisscross 8y ago> wised up and switched to random 16-character responses As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too. [1] https://news.ycombinator.com/item?id=18203907 https://news.ycombinator.com/item?id=18203907
- ryandrake 8y agoI’d love to know which businesses have such an asinine policy. Name and shame! They are basically allowing a password reset with zero authentication.
- jjeaff 8y agoCompany policy wouldn't matter as much as just getting the wrong customer service rep that is trying to be a bit too "helpful". In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.
- lapnitnelav 8y agoAny business large enough to have call centre like operations - and the cost-centre mindset that goes along - where people are underpaid and pressured to take as many calls as they can?
- feanaro 8y agoNaming and shaming of sufficient magnitude would put pressure to select for more strict customer service representatives. If they could get fired for doing that, they would think twice.
- jjeaff 8y agoI think a better idea, due to the issues pointed out by others, is to use valid sounding answers but not real answers. So if your mother's maiden name is Smith, don't put f4jjedglkej. Put something like "Anderson" and then store that answer in your password manager. This is what I do in order to avoid potential social engineering or employees that are simply confused by a gibberish answer.
- jcranendonk 8y ago1password actually supports password generation of the 'correct horse battery staple' variety, bypassing this issue entirely.
- tokyodude 8y agowhen will 1password be hacked? genuine question. is that a worry or is there something about the implementation that makes that not a worry?
- exolymph 8y agoWhen LastPass was hacked, the way they stored data helped protect users: https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ https://blog.lastpass.com/2015/06/lastpass-security-notice.h...
- tokyodude 8y agoIt's funny that in a topic complaining about a company who spies on it's users someone brings up Last Pass which says right in it'a TOS they spy on all your browser traffic and share that info with marketing partners https://www.logmeininc.com/legal/privacy https://www.logmeininc.com/legal/privacy it basically says they collect everything possible to collect and will use it for anything they want including sharing with 3rd parties
- cheez 8y agoSo that's why they want me to change my password (I've had the same one since pre-acquisition days.)
- hindsightbias 8y agoHow about "donotgiveoutoverthephone"?
- oconnor663 8y agoI like the idea of doing this plus the random characters. "identity theft high risk 2fZMbjL1lLZgnS8La"
- EpicEng 8y ago>The attacker says “Ah, a bunch of random characters, do I have to say it? The vast majority of users aren't using random characters, so how would they know to say that to begin with? Are you implying they try that line, idk, 10,000 times until it (maybe) works?
- bsurmanski 8y agoone idea: attacker accesses recovery answers for site A. Sees that it is random characters. Attacker has access to site A. Attacker phones sites B,C,D and E, trys social engineering. Attacker now has access to site B,C,D,E also.
- cortesoft 8y agoNah, it would go like this: Support: what is your fathers middle name? Hacker: Michael Support: sorry that is wrong Hacker: oh shoot, I forget I always put the incorrect information in this one... i can't remember, did I put a fake name or random characters? Or was this the one I put a bunch of words into? Support: yeah, it looks like random characters... let's move on
- pbhjpbhj 8y agoProper training, required. That person presumably is legally liable as they've breeched the providers security by giving information; and maybe given away PII.
- acct1771 8y agoThis is the point of failure. This never comes to fruition. "Computers are hard, and I'm just not very good with them!"
- rkagerer 8y agoSecurity Answer: HelpAnImposterIsTryingToHackMe
- mLuby 8y agoOf course, if the customer service rep can see the plaintext, it's not particularly secure is it?
- will4274 8y agoYou can get a fair amount of entropy out of names, and there are often multiple name type questions (somebody's maiden, friend's nickname, favorite teacher). Luckily it's hard to hammer customer service reps with repeated attempts, at least until the AI for voice personal assistants get a little better.