7 ms·
Banks and the rest hate me. I use keypass to generate random alpha numeric 'passwords' I use for the answers to personal questions.
by edoo 8y ago
Banks and the rest hate me. I use keypass to generate random alpha numeric 'passwords' I use for the answers to personal questions.
- RickS 8y agoWhat are some of the ways this blows back? Having to answer them over the phone when they're not passwords, but more like customer service gatekeepers? I do this as well and it has yet to blow up in my face, though it does seem like an inevitability.
- edoo 8y agoI used to do a slightly different system where I'd have ridiculous answers, sort of a word game play on the question itself, and forgetting your secret answers with a company like Verizon can take days to figure out.
- AckSyn 8y agoI do this but instead of passwords like `NGIyNzgwMTEyNDczYTIyNjEwYWRhYWZh` I'd use `BatteryHorseStaple33` to the question: Where were you born. I've never had it blow up in my face with any rep, and I make sure to keep the passwords in an offline (never touches any network) laptop.
- captn3m0 8y agoMy bank (HDFC India) specifically states while setting up the security question that the bank will never ask for these (over phone or elsewhere), so I'm happily using random UUIDs
- jandrese 8y agoWhat is the point of a security question if they never use it?
- greenshackle2 8y agoHDFC appears to have truly terrible security, someone managed to sign up with my email address and a really weird mailing address - like an airport warehouse or something, then proceeded to fill up the card and never paid it back. I emailed HDFC about it but they never responded. Apparently they don't even do e-mail verification.
- telesilla 8y agoI got pretty good at memorising alpha bravo charlie[1] so I just jump straight into that, and for characters like #, * and ! I try and use the word I know is most common, e.g. in english "pound", "star" and "exclamation mark". "hash" and "bang" get me what I suppose are the equivalent of blank looks.. So I have nicely complex passwords generated by Keepass and the staff usually don't think anything of it once I mention I work in "computers". [1] https://en.wikipedia.org/wiki/NATO_phonetic_alphabet https://en.wikipedia.org/wiki/NATO_phonetic_alphabet
- nothrabannosir 8y agoI have personally experienced a CS rep accepting “it’s just a bunch of random characters” as an answer. Combined with the fact that you just went on the record as using that scheme, your opsec just took a dramatic hit. Use plausible sounding, but random answers.
- panopticon 8y agoThe first time I had a CS rep require me to recite my 64-character alphanumeric answer was what prompted me to switch my strategy. Now I generate a list of four arbitrary words for every answer to security questions... so much easier to answer.
- samstave 8y agoWhats the name of the first school you went to? "School" Whats the name of your first pet? "Pet" --- I use this scheme when i need to come up with these types of answers for a service that i dont deem as super critical or risky...
- vermilingua 8y agoThat’s twice in this thread that someone has revealed pretty potent details of their personal security.
- tvanantwerp 8y agoGot bitten by this when I had to give a 32-character alphanumeric answer over the phone. I groaned and asked, "Can I just give you the beginning and the end?" The rep laughed and accepted my compromise. Since then, I use a collection of random words (in the style of correct-horse-battery-staple) for security questions.
- pasbesoin 8y agoI treat them as less secure passwords -- passwords that often a representative at the company has access to. (I've experienced instances of people on the phone (upon my calling the organization at a known number) soliciting their answers and checking them against what they have on their screen. Usually these days, with actual passwords, they undergo a computerized check and members of the organization have no access to their values -- or at least to their unencrypted values. (Although, don't blindly depend upon that assumption.) Security questions introduce insecurity. I remember being mightily puzzled when they were considered a "best practice" and the organization I was at was all "het up" to implement them. The real reason? They save head count / expense -- at least, in the short run. One less "I can't remember my password" interaction -- one that, from an optimistic perspective, at least doesn't just blindly depend upon emailing the email address of record... Only, many sites seem to implement that alongside their security questions flow, so...
- adzm 8y agoDiceware phrases work well here, too!