16 ms·
I look at security questions and answers as a challenge and response. I stopped answering them logically when I realized I don't have to. So the answer to "Wher
by nulbyte 8y ago
I look at security questions and answers as a challenge and response. I stopped answering them logically when I realized I don't have to. So the answer to "Where would you like to retire?" might be "the sky has a long face." I won't ever use them unless resetting a password, and I won't be resetting a password unless I mess up synchronizing my password manager. Except when I do need them, because the dip shit that operates the site doesn't "recognize" the computer (browser session) I'm using. That crap needs to go.
- TimTheTinker 8y agoI just generate more passwords for the security questions. Since I’m using a reliable, backed-up password manager, my primary concern is protecting my account from would-be hijackers, not resetting a potentially lost password.
- twothamendment 8y agoYes, because there is no way I'm answering what city I was married in. It is public record. A password-like "nonsense" answer is the only way to go.
- WorldMaker 8y agoThe one thing I try to do is make sure whatever password generator I use for these produces pronounceable passwords in English that are relatively easy to spell, because so many of the places that want these really mean "Phone password".
- TimTheTinker 8y ago1Password integrates with the iPhone's built-in password manager, so I'm never stuck typing in passwords anymore.
- WorldMaker 8y agoThe issue isn't typing them. The issue is that many "Security Questions" are secretly "Phone Passwords" because customer service representatives can see them in plaintext and will ask you them if you ever have reason to call them over the phone. Making sure that they are pronounceable (mostly) English words avoids some of the potential awkwardness of reading them out of your password manager over the phone, even if they are intentional random gibberish. It also partly avoids the social engineering trap of "it's just random garbage" because at least if it looks like words a customer service rep may still ask for them anyway rather than not bother to one-at-a-time review a series of random characters.
- TimTheTinker 8y agoOk, gotcha. 1Password can also generate passphrases from dictionary words. Agreed, the “it’s a bunch of gobbledygook” social engineering hack is a really serious vulnerability.
- wwweston 8y agoThis is fairly effective until the day comes when you use this method on a system that tries to be even nicer about password recovery... and presents your answers in a multiple choice context. Where would you like to retire? ( ) Miami Beach, Florida ( ) Nice, France ( ) the sky has a long face ( ) Bozeman, Montana