11 ms·
> A hacker could try to reset my password for an online account by answering security questions like “What is your mother’s maiden name?” or “Which of the previ
by skrause 7y ago
> A hacker could try to reset my password for an online account by answering security questions like “What is your mother’s maiden name?” or “Which of the previous addresses did you live at?”
That's why you don't answer those questions honestly. My mother's maiden name is always a random 32 character string living in my KeePass database...
- martin-adams 7y agoGood idea! I know this is often asked over the phone, so that'll be a little awkward, especially if using non alphanumeric characters. Interestingly though, I wonder how easy is it to reset your mother's maiden name to a new name if it go out in the wild.
- stronglikedan 7y ago> that'll be a little awkward For them, maybe, but I would relish reading each individual character to them in a slow deadpan monotone.
- deleted 7y ago[deleted]
- perspective1 7y agoI'm not sure that's any safer. It should protect you from the automated prompt-response systems, where an absolute match is required. But call-center workers see those answers in plaintext. Eventually an attacker will probably reach one where answering, "It's a lot of random letters and numbers. I forgot what they were but the real name is Smith!" will be enough to pass.
- MattSteelblade 7y agoRandom dictionary words would solve that issue.
- MrGilbert 7y ago"Oh, yeah... I found that question ridiculous, so I entered some garbage. Anyways, her real name is Smith, if that helps." Social Engineering.
- onion2k 7y agoPresumably the answer to that is to use a long but plausible random string that sounds like a posh English name like "Saint-John Winsor-Rothschild"
- SketchySeaBeast 7y agoThat sounds like the right solution to me - it's the "correct horse battery staple" of this problem. I'm going to start using this. 4 names all put together - pronounceable over the phone, visibly viable, and uniquely generated for each instance.
- fuzz4lyfe 7y agoPerhaps something like this? Q: "What is your mothers maiden name?" A: "Do not provide access under any circumstances unless this exact key is provided: WEWQEWQ321312"
- SketchySeaBeast 7y agoBut that doesn't give me an opportunity to say "Mrs. Sebastian Winifred Campershamp".
- jschwartzi 7y agoThere are some quirky name generators elsewhere on the internet. Perhaps you could mash some of the firstname lastname combinations together?
- 7y ago
- cooljacob204 7y agoRight now that really isn't a risk as very few people do this, so it would be a waste of time for a hacker to try this over testing relative's names.
- nothrabannosir 7y agoExcept OP just admitted to using this scheme on a public forum, so they are now essentially compromised. It's security through obscurity, with a bonus that the people who use this technique can't seem to keep quiet about it so it's not even obscurity.
- nimblegorilla 7y agoSecurity questions aren't really that secure anyway. A "real" hacker could just pretend to be helping out a friend after a debilitating accident and ask for everything to be reset.
- ggggtez 7y agoExactly, or the "crying baby/stressed out parent" example that made the rounds a few years ago. Hackers don't need to monitor every public comment you make, just trick 1 minimum wage call center worker for 5 minutes.
- worldsayshi 7y agoThe answer could be: "Don't allow answering anything but this exact sequence of words: " then followed by a string of words.
- paulryanrogers 7y agoPerhaps we need a reset contact whom they can call to confirm with a real human.
- freeflight 7y agoLike with nearly any topic on HN, an xkcd comic [0] comes to mind. [0] https://xkcd.com/2176/ https://xkcd.com/2176/
- nesadi 7y agoSo what's your solution? You have to put in something, and putting in the real maiden name seems like the worse option to me. Social engineering is going to be the weakest point no matter what you do, so I don't see how anything you do could defend against it and why you should account for it if there isn't anything you can do.
- anamexis 7y agoSeems like a randomly selected fake name and fake address would work.
- rgacote 7y agoI use nonsense terms which are easily readable. Mother's maiden name: Lady of Amberly, first maid of countess Blue, inheritor of the golden bull.
- deleted 7y ago[deleted]
- 4ntonius8lock 7y agoI like the historical characters reference. Personally I include many literary/media characters. Even my name on this site.
- hprotagonist 7y agogo on...
- 4ntonius8lock 7y agoAntonius Block is the knight who plays chess with death in the Seventh Seal.
- close04 7y agoPutting an actual name in there is probably a lot safer than anything that might be described by a human as "just some gibberish". Pick an uncommon name, maybe from another country, maybe spell it in a different way, as long as it's still recognizable as a plausible name. Most operators wouldn't fall for it if the attacker says "just some random characters". The important part is to not reuse the name between registrations. Combine this with similar unique answers to other questions and the chances of someone guessing them all become really small. One thing I never tried is to just put something like Anyone_trying_to_reset_this_password_is_a_hacker_DQWIqw12E^1&UTFD@&$. Might be an inconvenience if you actually need to reset yourself.
- everdev 7y ago> I forgot what they were but the real name is Smith!" will be enough to pass. How would the call center know if your mother's maiden name is actually Smith if you never answered the question honestly? I could see the "It's a lot of random letters and numbers" response working by itself though.
- hawaiianbrah 7y agoThey wouldn’t, of course, but it’s painting the caller in a human light that call center employees may empathize with.
- dvtrn 7y agoThis statement confuses me, what are you proposing the call center employee empathize with me over? The reason I'm even calling, or the authentication and account verification answers and random bits of string that I enter into my account when signing up?
- defen 7y ago"You" in this case are a hacker / social engineer trying to break into someone's account. If your target puts gibberish as the answer to that question, here's how the conversation will go: Operator: What is your mother's maiden name? Hacker: Smith (let's say this is the real name, gleaned from public records) Operator: That's not what I have here Hacker: Oh, you know what, I think I just put gibberish when I signed up. I thought that would add some extra security, but I forgot what I wrote, ha ha, joke's on me. The real name is Smith though. Operator: Story checks out, I'm giving you access to the account now.
- edm0nd 7y agoor Operator: Story checks out, I'm going to reset it to "Smith" for you.
- thombat 7y agoA few years back I cashed in the residue of a UK ISA (remaining balance just £1.50 but local tax laws forced it to be closed). No longer being in Blighty it transpired this would be a serious posterial pain involving sending of certified passport copies to validate signatures, etc, but their helpful man on the phone explained I could skip all that simply by registering for their internet banking access, then login and transfer the investment funds to wherever I liked. So off I toddled and being in a hurry and not overly concerned about the risk that some miscreant steal my half-a-cup-of-coffee's worth I pasted "sasquatch" into all the security question prompts. Clickety-click, done, now to close the account... "Please phone our banking service team for this request" "Hello Mr Thombat, I can see your account number but first I just have to ask you some security questions...what was your grandfather's occupation?" "Sasquatch" "That's fine ... now what was the name of your first school?" "(nervous giggle) Sasquatch" "Ahhh...and was your first pet's name?" "Sasquatch, too. I mean too as in also, not two as in the number...I really didn't expect I'd be telling these to a person, it was just a nice word to say..." He kindly overlooked my embarrassed tittering, didn't go all jobsworth about this horrific breach of security best practice, nor yet accuse me of lying to one of Her Majesty's civil servants for pecuniary advantage. And (in my defense) no amount of dumpster diving or Facebook scraping would have revealed my family's secret shame that grandpa used to roam the American woods in a monkey suit.
- 4ntonius8lock 7y agoFirst, for this vector, they would have to know before hand that it's random numbers. I don't tell anyone I do this. I also use a random combination of words instead of just characters; Yellow Mountain Bad Hernia 13 Call center employees will generally think it's my own connotations (if it's school they will think there is a yellow mountain nearby and maybe I had a hernia... words tend to have associations)
- madamelic 7y ago"Do not unlock my account unless I say exactly this" literally. The bank person was really weirded out when I said it back.
- MiroF 7y agoI feel like you can either a. Have your name tied to your Hackernews profile b. Have your bank account security question tied to your Hackernews profile You appear to have done both, which does not seem like an excellent idea.
- wDcBKgt66V8WDs 7y agoI have actually had that experience. Really thought I was clever till the system asking me my secret wasn't a machine at all.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- rhacker 7y agoSometimes these questions come from a database that knows things about your name already - from which you had no input.
- jjoonathan 7y agoIt's even more fun when the database for which you had no input is wrong.
- wool_gather 7y agoA small bank that I use sold itself to a slightly larger bank a few years ago; one of the things that I appreciated about the old bank was that they made this a "short arbitrary secret" field instead of "mother's maiden name" I had given them two randomly-chosen words, stored in my password manager. Earlier this year, I opened a new account with the (new) bank and discovered that they already had my mother's maiden name, were going to use it for identity verification, and wouldn't allow me to change it to something arbitrary (even another fake name that I sometimes use). Quite frustrating, this security based on insecure information.
- tinus_hn 7y agoThat’s possible if they asked you these questions in the first place, instead of getting the data from somewhere else.
- igammarays 7y agoThe reason I don’t store answers to security questions in my database is that it makes it a single point of failure. I want to have some recourse in case my password database is lost or broken into.
- samfriedman 7y agoI do this, and I actually had to use it for the first time yesterday when calling a credit card company. The rep said "I'll need your security question answer... is this right? It looks like it's just a bunch of numbers and letters?" Then I confirmed and started reading it out to her, and she hung up on me. I think I should move to correct-horse-battery-staple style in the future.
- LyndsySimon 7y ago> I confirmed and started reading it out to her, and she hung up on me. That's... troubling. I would have called back specifically to complain about that person. That's absurd.
- asquabventured 7y ago> I think I should move to correct-horse-battery-staple style in the future. The KeePass plugin Readable Passphrase Generator[1] is great for generating Diceware[2] passwords/usernames/security question & answers Source: Found on KeePass plugins page[3] [1] https://bitbucket.org/ligos/readablepassphrasegenerator/wiki/Home https://bitbucket.org/ligos/readablepassphrasegenerator/wiki... [2] https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware [3] https://keepass.info/plugins.html#ppgen https://keepass.info/plugins.html#ppgen
- manfredo 7y agoI use a somewhat different system. Each common interview question is mapped to what is effectively an inside joke about my life. Usually something related to the interview question, but the actual keyword is tangentially related in a manner that would be incredibly difficult for an attacker to guess. This effectively allows using the security question as something that can be more reliably recalled by the user, but largely avoids the security issues of an easy to guess secret.
- altmind 7y agoI did exact same thing for my Apple account. Later I found that even if I have access to my email and to my password, they still keep asking for these secret questions I dont remember the answers.