9 ms·
Not the direct point of the article, but as an aside, it really concerns me how easy it is to find a mother's maiden name these days, considering how often it's
by btgeekboy 8y ago
Not the direct point of the article, but as an aside, it really concerns me how easy it is to find a mother's maiden name these days, considering how often it's used as at least a partial proof of identity.
- rootusrootus 8y agoSeems like it shows up on nearly every married woman's Facebook profile.
- brk 8y agoThat would be HER maiden name, not her mothers.
- thefreeman 8y agoI think he was referring to the mother's facebook page.
- brk 8y agoPerhaps. My anecdotal experience does not show a high ratio of women on facebook who are also friends with their mothers. I have also noticed older seem to list their maiden name less frequently. However, I do agree that in general several "security questions" that are meant to be hard-to-guess data points are actually easy to find the answer to frequently. Maiden names, and school names/cities/mascots, are often found in online profiles in one way or another. At the same time, I'm not sure the risk is as large as it seems. These security questions help prevent bulk identity theft and add a friction point to the process, they are certainly not equal alternatives to real 2FA, but they are also less "brute forceable".
- edflsafoiewq 8y agoIt was never a secret to begin with.
- Wohlf 8y agoExactly, it was how she identified herself for years.
- nmstoker 8y agoDoesn't that simply highlight how unfit for that purpose it is (along with things like Social Security numbers in the US)?
- ghaff 8y agoI am guessing that most standard and reliable (i.e. you know the answer and it's not going to change) questions are vulnerable to discovery by a halfway determined attacker. That said, there are probably questions/answers that historically would have required at least some degree of serious investigation to uncover that are now often trivially discoverable.
- inflatableDodo 8y agoI have thought for a while that the old 'what is your porn name?' joke of combining first pet's name and mother's maiden name was probably originally invented by con artists looking to gather info.
- wccrawford 8y agoI don't think it was invented by them, but I'm sure it's been used extensively by them since then. I think it was just someone that thought it was funny.
- inflatableDodo 8y agoGiven the use of pets names and maiden names as common authentication tokens for money, that it is a kind of weird joke to start with and that it doesn't really have a punchline and can easily fall flat, it stinks of grifter patter. Though it isn't as bad as; 'You can't cheat an honest man'. You hear someone saying that, you start counting your fingers before you shake hands and check them again as soon as your done.
- r_smart 8y agoYou should be giving gibberish answers to those anyway. They're probably stored as plaintext, but on the off chance they're not, treat them as a backup password and don't answer the question honestly.
- roganartu 8y agoFor anything that involves human interaction for the verification, this doesn't really work. I generate random strings for these and store them in my password manager. On several occasions I've called companies for whatever reason and they've asked these questions to verify my identity. When I say "oh it's a random string let me open my password manager to confirm it" they often reply with "oh it's ok, you're right it's gibberish" and consider me verified.
- dboat 8y agoHad the same experience with blizzard support a while ago. Now I follow the above poster's advice and use it as a secondary password, but make it pronounceable at least.
- r_smart 8y agoYeah, I shouldn't have said 'gibberish' but rather random words / lies. Just don't answer the questions basically.
- david-s 8y agoI've taken to making them say "this is not random (insert password here)". Still haven't seen if that actually works in practice.
- wlesieutre 8y agoYou’re probably still better off with reasonable but fake answers. First pet was named October, your parents met in Tennessee City, etc.
- 8y ago
- neilwilson 8y agoIn the UK it is on the birth record database that is publicly available to anybody. If you know the person's name and roughly when they were born (which you can get from the age) and where, you can get the Mothers Maiden name easily. I found mine here https://www.freebmd.org.uk/cgi/search.pl https://www.freebmd.org.uk/cgi/search.pl in a couple of clicks.
- godot 8y agoVery tangential note: a url like /cgi/search.pl certainly brings back nostalgic memories! Good old days of cgi-bin and perl scripts.
- Zenst 8y agoThis is a handy site - https://www.freebmd.org.uk/cgi/search.pl https://www.freebmd.org.uk/cgi/search.pl But looking up myself (and my brother) I noticed that the record date is a month or two past the actual month. So for me being born in March seeing myself listed as June and in my Brothers case seeing September listed as December. Well, makes me wonder if they had backlogs back then. But most happy it is that way, I know my actual birth certificate has the correct date (still have the original) and those are accessible in some form or another. Just mindful that not all records are that accurate.
- neilwilson 8y agoThe summaries are recorded per quarter. Hence the Mar, Jun, Sep, Dec dates
- jloughry 8y agoMother's maiden name is documented to have been in use for authentication at least as far back as 1882, and even then it was known to be a weakness [1, §3]. [1] Stephen M. Bellovin. 'Frank Miller: Inventor of the One-Time Pad'. Cryptologia 35(3), pp. 203–222, 2011. DOI: 10.1080/01611194.2011.583711
- hombre_fatal 8y agoIt's also funny how you're supposed to submit such (ostensibly) personally identifying information to a website for them to know. So it literally only works for this purpose the first time you do it, now it's not private anymore (even if it was to begin with). Now it's on file just waiting to be leaked. For example, how many of us are suckers who have submitted scans of our passport and drivers license to a website like coinbase.com? It's only a matter of time until https://haveibeenpwned.com/ https://haveibeenpwned.com/ lets you type in your DL/passport number and it'll tell you how many scans it found in data dumps.
- glvn 8y agoJust don't answer those questions "truthfully. What I mean is I use 1password to store my credentials. So whenever a site asks me to provide 3 security questions and answer I will usually select 3 random questions (especially ones that don't apply to me like "where did you meet your wife", well i'm not married), then provide an answer like "dog bow rainbow toss three". Even if one place is breached and hackers find my "mothers maiden name", it's about as useful as a one time access token.
- deleted 8y ago[deleted]
- ceejayoz 8y agoYou should consider using a real-looking answer. Someone doing social engineering may answer "It was a bunch of random characters/words, I'm sorry I don't have it in front of me" and have that accepted. If they don't accept it, hang up and try again with another rep until someone does. Picking a random real place off Wikipedia (different for each website, and store that in 1password) avoids this.
- wolco 8y agoWould this work with a real wikipedia word. Oops I can't remember call back.
- deleted 8y ago[deleted]
- c22 8y agoMy mom never changed her last name, I always thought this "security" question was pretty absurd.
- js2 8y agoI’ll test this assertion. What’s my mother’s maiden name? (Now that I think about it, it shouldn’t be too hard to find.) (And to your point, I literally had to provide it earlier this week to Chase’s fraud department.)
- aldoushuxley001 8y agojs1
- TinyRick 8y agoKlass?
- js2 8y agoThat was pretty quick. Can I ask how you found it?
- cornstalks 8y agoNot OP, but I found it by going to your HN profile, seeing your email listed there, searching that username, finding a GitHub profile with the same username, then using your first and last name plus your location (listed in your GitHub profile) to look you up. Your profile photo on GitHub gave me your approximate age (middle age, clearly not a teenager or a senior). Searching your name and city+state in Google shows several websites that collect public records and show relatives. Some include age with names. The only people that showed up as relatives that were plausibly your parents (based on age) were two people: one with your same last name (probably your father), and one with a different name (Klass) (most likely your mother).
- js2 8y agoThanks. I knew it was easy to get to my name from my HN provided info. I wasn’t sure how easy it was to get from there to my parents. Having a pretty rare last name makes it really hard to stay anonymous, especially when you engage in public activities like entering road races, buying a home, and voting. Guess it’s a bit late to start using a pseudonym. Edit: mylife is insane. I’ve googled myself in the past and this much information didn’t used to be so readily available in search results. I don’t know how a right to disappear would even work when a bunch of the results are curated straight from public records. Edit 2: I think if I cared more about this I’d have to engage in a prolonged disinformation campaign to muddy the search.
- slg 8y agoBeing able to identify someone over the phone or internet is an incredibly hard problem that I think more startups should be working on. It is a constant battle between security and customer convenience. It is very frustrating being locked out of your own account because a company can't identify you correctly. If you combine that with the fact that companies are rarely held accountable for these security violations and it isn't a surprise that they optimize for customer convenience. The best systems I have seen are the ones that use your credit history to ask you several questions like "Which one these four streets have you lived on?" or "Which one of these four employers have you never worked for?", but even those are gameable with some research. There has to be some better solution out there.
- packet_nerd 8y agoWouldn't a Google Auth type TOTP be ideal for over the phone? Is there anyone doing this? It could be the same one I use for 2FA to the website. Or, an entirely offline flow would work too where they sent a dead-tree mail with the shared secret in QR code format.
- organsnyder 8y agoI think that's one of the best solutions, but it would add a ton of customer service overhead for lost devices (if physical OTP generators are used), clock sync issues, device-specific quirks... And if we want to have a universal system for this rather than each service provider having their own one-off solution, someone would need to foot the bill.
- jeltz 8y agoSwedish banks already do this. They first implemnted their own systems with custom hardware (and before that banks mailed a physical scratch pad with codes) but then later together developed a mobile app (called Mobile BankID) which can be used for authentication. So clearly it can be done. Swedish banks have been doing it for at least 20 years.
- deleted 8y ago[deleted]
- ethor 8y agoIn Sweden we have ”Mobilt bankid” which is a digital identification that you download from your bank and then assign a password to it. After this has been completed you can identify yourself through an official app. Most serious organizations asks you to identify yourself through this app when handling business over the phone.
- maxheadroom 8y agoJa och nej. BankId is a 2FA mechanism that proves that you are who you say you are. Before you can download the mobile app (Mobilt BankId) and assign a password, the bank must issue you a card with a certificate on it (BankID på kort[0,1]). You use this card to then validate the Mobilt BankId, since it creates a chain-of-custody for identity, as it were. In other words, someone with your personnummer on-hand can't just download Mobilt BankId and then assign their own password because they're lacking the physical evidence [read: the BankId på kort], which prevents them from falsely representing that they are you. How Mobilt BankId works with BankId is that it houses a certificate (much the same as BankId på Kort) and leverages the same auth prompting mechanisms for challenge/response to authenticate the user. Essentially, it "replaces" the kort but only in the sense that the kort is required to be physically present in the system. With the Mobilt BankId app, the certificate is always present. Sorry for the long-winded explanation but it isn't as simple as downloading the app and assigning a password and don't want people to get the wrong idea. :( [0] - https://www.bankid.com/en/om-bankid/detta-ar-bankid https://www.bankid.com/en/om-bankid/detta-ar-bankid [1] - https://support.bankid.com/sv/bankid/bankid-pa-kort https://support.bankid.com/sv/bankid/bankid-pa-kort
- chris_mc 8y agoMy kids will have their mother's name as their last name, so what do they do, use their father's, uh, bachelor name?
- moyix 8y agoThis has always been a funny "secret" to me since I have a hyphenated last name – gee, my last name is "Dolan-Gavitt", I'll give you two guesses what my mother's maiden name is.
- buttcoinslol 8y agoI would have no idea what your mother's maiden name is? With only your post as a reference point, I would assume that you're a woman married to a man, and then assume Dolan is your paternal last name, and Gavitt is your married last name. Encountering men with hyphenated last names is uncommon enough (for me) that I don't know the rules for that, so if that's the case, I don't know either.
- moyix 8y agoIt's semi-common (or was, in the 80s) for couples who didn't want to change either of their names to instead give their kids a hyphenated name with both the mother's and the father's name. So my mother's maiden name is... Dolan.
- cortesoft 8y agoYeah... my mom's maiden name is her current last name (didn't change her name when she got married) and my middle name as well. It really is a pretty outdated and sexist system, really.
- deleted 8y ago[deleted]
- ummonk 8y agoDNA would actually be a great way of doing identity. As long as you're alive, your DNA can be checked. And it's not really feasible for someone else to fake. You also don't lose it or forget it, like you would password or 2FA device.
- cortesoft 8y agoYou also can't change it, though, if someone gets a hold of it. Someone with a bit of your blood could impersonate you forever, and you wouldn't be able to stop them.