3 ms·

> The best systems I have seen are the ones that use your credit history to ask you several questions like "Which one these four streets have you lived on?"...

> The best systems I have seen are the ones that use your credit history to ask you several questions like "Which one these four streets have you lived on?"... At least with simple "mother's maiden name" type questions, you could, if you were concerned by its insecurity, choose to use a secret value. With the automation of the process, that is not an option, while the security value of this pseudo-secret information will be eroded by its inevitable over-use.

slg 8y ago
You do make a good point, but the made up answer option is basically just opting out of the system for both good and bad. In my experience, the mother's maiden name thing is rarely the primary identifier. It is usually used if the primary identifier like a password or passcode isn't known. So the question becomes in what instances would a person have a record/memory of the fake name but no record/memory of their password? The only situation I can imagine that happening is if the person reuses their fake name which defeats the whole point of doing this for the added security. The end result is that the secondary identification system has almost no value.
- Namrog84 8y ago
  > So the question becomes in what instances would a person have a record/memory of the fake name but no record/memory of their password? I have both recorded in password vault and both are random. The benefit is it they've reset my password for some reason or it was hijacked. I've been able to recover accounts. Not because I forgot a password but because it was essentially a harder to change 2nd "secret"
- mannykannot 8y ago
  > So the question becomes in what instances would a person have a record/memory of the fake name but no record/memory of their password? That is, indeed, the problem that these questions are supposed to avoid, but they only offer sort-of security to the extent that the information is sort-of confidential. Anything that the automated validation service can find from public sources can also be found by the black hats, and the more common these automated services become, the more worthwhile it will be for the black hats to similarly automate their search for them. The end result is that real security that is based on something you know has to depend on secrets.
- dhimes 8y ago
  For me (and I know others), the rule is to never give the correct answer to any of those questions (what was name of first pet? what elementary school?). That's how Sarah Palin was doxxed

slg 8y ago

You do make a good point, but the made up answer option is basically just opting out of the system for both good and bad. In my experience, the mother's maiden name thing is rarely the primary identifier. It is usually used if the primary identifier like a password or passcode isn't known. So the question becomes in what instances would a person have a record/memory of the fake name but no record/memory of their password? The only situation I can imagine that happening is if the person reuses their fake name which defeats the whole point of doing this for the added security. The end result is that the secondary identification system has almost no value.

Namrog84 8y ago
> So the question becomes in what instances would a person have a record/memory of the fake name but no record/memory of their password? I have both recorded in password vault and both are random. The benefit is it they've reset my password for some reason or it was hijacked. I've been able to recover accounts. Not because I forgot a password but because it was essentially a harder to change 2nd "secret"
mannykannot 8y ago
> So the question becomes in what instances would a person have a record/memory of the fake name but no record/memory of their password? That is, indeed, the problem that these questions are supposed to avoid, but they only offer sort-of security to the extent that the information is sort-of confidential. Anything that the automated validation service can find from public sources can also be found by the black hats, and the more common these automated services become, the more worthwhile it will be for the black hats to similarly automate their search for them. The end result is that real security that is based on something you know has to depend on secrets.
dhimes 8y ago
For me (and I know others), the rule is to never give the correct answer to any of those questions (what was name of first pet? what elementary school?). That's how Sarah Palin was doxxed