4 ms·

Good point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "

Good point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "Favorite food: Manchester").

ryandrake 8y ago
I used to use real answers but then wised up and switched to random 16-character responses. I wish there was a way to find out which services I’m vulnerable on due to my stupidly using real data, without attempting to do a password reset on all of my online accounts.
- JumpCrisscross 8y ago
  > wised up and switched to random 16-character responses As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too. [1] https://news.ycombinator.com/item?id=18203907 https://news.ycombinator.com/item?id=18203907
  - ryandrake 8y ago
    I’d love to know which businesses have such an asinine policy. Name and shame! They are basically allowing a password reset with zero authentication.
    - jjeaff 8y ago
      Company policy wouldn't matter as much as just getting the wrong customer service rep that is trying to be a bit too "helpful". In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.
    - lapnitnelav 8y ago
      Any business large enough to have call centre like operations - and the cost-centre mindset that goes along - where people are underpaid and pressured to take as many calls as they can?
      - feanaro 8y ago
        Naming and shaming of sufficient magnitude would put pressure to select for more strict customer service representatives. If they could get fired for doing that, they would think twice.
- jjeaff 8y ago
  I think a better idea, due to the issues pointed out by others, is to use valid sounding answers but not real answers. So if your mother's maiden name is Smith, don't put f4jjedglkej. Put something like "Anderson" and then store that answer in your password manager. This is what I do in order to avoid potential social engineering or employees that are simply confused by a gibberish answer.

Good point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "Favorite food: Manchester").

ryandrake 8y ago

I used to use real answers but then wised up and switched to random 16-character responses. I wish there was a way to find out which services I’m vulnerable on due to my stupidly using real data, without attempting to do a password reset on all of my online accounts.

JumpCrisscross 8y ago
> wised up and switched to random 16-character responses As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too. [1] https://news.ycombinator.com/item?id=18203907 https://news.ycombinator.com/item?id=18203907
- ryandrake 8y ago
  I’d love to know which businesses have such an asinine policy. Name and shame! They are basically allowing a password reset with zero authentication.
  - jjeaff 8y ago
    Company policy wouldn't matter as much as just getting the wrong customer service rep that is trying to be a bit too "helpful". In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.
  - lapnitnelav 8y ago
    Any business large enough to have call centre like operations - and the cost-centre mindset that goes along - where people are underpaid and pressured to take as many calls as they can?
    - feanaro 8y ago
      Naming and shaming of sufficient magnitude would put pressure to select for more strict customer service representatives. If they could get fired for doing that, they would think twice.
jjeaff 8y ago
I think a better idea, due to the issues pointed out by others, is to use valid sounding answers but not real answers. So if your mother's maiden name is Smith, don't put f4jjedglkej. Put something like "Anderson" and then store that answer in your password manager. This is what I do in order to avoid potential social engineering or employees that are simply confused by a gibberish answer.