5 ms·

In this case a password like “to be repeated exactly: <random string>” has the same properties and can be divulged without affecting opsec particularly.

nothrabannosir 8y ago
(Un)fortunately, normal people don't think like programmers. That's why security questions exist, in the first place. Do you think they won't accept "It's to be repeated exactly, and then gschgschgsch. Ahh, youth. Those were the days." If you think that's bad: I always enter a fake phone nr. Once, a company turned out to use them as verification for phone support. I didn't know, and had forgotten, so gave my actual number. "Oh, it says something else here. Shall I just go ahead and remove that, then?". I wanted to cry. Don't play games.
- function_seven 8y ago
  Not that I condone this strategy, but what is the threat model where an impersonator knows to say, "It's to be repeated exactly, and then adso&#fjsou..."?
  - nothrabannosir 8y ago
    I'd go with "putting your security question strategy on a public forum", for starters. Security through obscurity strikes again.
    - function_seven 8y ago
      Well yeah, in this case that's the weakness. But before parent announced their strategy on this forum, what was the threat model? Hell, let's assume OP obfuscated the introductory part in their comment to avoid that leak.
      - ChristianBundy 8y ago
        If they're willing to brag about their passwords on the internet, I'd be willing to bet that family and friends have the same information. Assuming that wasn't true, a customer service rep for the phone company could call the customer's bank and try to impersonate the customer, assuming it's used often (like the poster stated).
lozaning 8y ago
Im always shocked by how small the fields for some of those inputs are though. How much space for entropy do you have left after including the notice about needing an exact match?

nothrabannosir 8y ago

(Un)fortunately, normal people don't think like programmers. That's why security questions exist, in the first place. Do you think they won't accept "It's to be repeated exactly, and then gschgschgsch. Ahh, youth. Those were the days." If you think that's bad: I always enter a fake phone nr. Once, a company turned out to use them as verification for phone support. I didn't know, and had forgotten, so gave my actual number. "Oh, it says something else here. Shall I just go ahead and remove that, then?". I wanted to cry. Don't play games.

function_seven 8y ago
Not that I condone this strategy, but what is the threat model where an impersonator knows to say, "It's to be repeated exactly, and then adso&#fjsou..."?
- nothrabannosir 8y ago
  I'd go with "putting your security question strategy on a public forum", for starters. Security through obscurity strikes again.
  - function_seven 8y ago
    Well yeah, in this case that's the weakness. But before parent announced their strategy on this forum, what was the threat model? Hell, let's assume OP obfuscated the introductory part in their comment to avoid that leak.
    - ChristianBundy 8y ago
      If they're willing to brag about their passwords on the internet, I'd be willing to bet that family and friends have the same information. Assuming that wasn't true, a customer service rep for the phone company could call the customer's bank and try to impersonate the customer, assuming it's used often (like the poster stated).

lozaning 8y ago

Im always shocked by how small the fields for some of those inputs are though. How much space for entropy do you have left after including the notice about needing an exact match?