9 ms·

Random dictionary words would solve that issue.

MrGilbert 7y ago
"Oh, yeah... I found that question ridiculous, so I entered some garbage. Anyways, her real name is Smith, if that helps." Social Engineering.
- onion2k 7y ago
  Presumably the answer to that is to use a long but plausible random string that sounds like a posh English name like "Saint-John Winsor-Rothschild"
  - SketchySeaBeast 7y ago
    That sounds like the right solution to me - it's the "correct horse battery staple" of this problem. I'm going to start using this. 4 names all put together - pronounceable over the phone, visibly viable, and uniquely generated for each instance.
    - fuzz4lyfe 7y ago
      Perhaps something like this? Q: "What is your mothers maiden name?" A: "Do not provide access under any circumstances unless this exact key is provided: WEWQEWQ321312"
      - SketchySeaBeast 7y ago
        But that doesn't give me an opportunity to say "Mrs. Sebastian Winifred Campershamp".
        jschwartzi 7y ago
        There are some quirky name generators elsewhere on the internet. Perhaps you could mash some of the firstname lastname combinations together?
        SketchySeaBeast 7y ago
        That's my thought. Now we need to get a KeePass extension that does that. It'd be even better if it generated where you went to high school and your first pet's name as well. Though that too could be Mrs. Sebastian Winifred Campershamp.
        lozf 7y ago
        > Mrs. Sebastian Winifred Campershamp Definitely more plausible as a pets' name than a maiden name. </pedant>
        jschwartzi 7y ago
        This is a very Corgi name.
      - jodrellblank 7y ago
        muffled voice with strong accent, from call center, over long distance VOIP line which should be perfect clarity but mysteriously isn't, loud background noises, crackles "Sorry I did not hear, but there seems to be a problem with our computer system I am getting an error message instead of a name, please can you call back later". Screen shows them: "Do not provide access und" 25 character silent truncation.
  - noirbot 7y ago
    Now I want someone to make a password generator that's just fancy hyphenated names. I can't imagine it would be too hard to make.
    - jachee 7y ago
      Just beware the Falsehoods Programmers Believe about Names: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
      - resoluteteeth 7y ago
        This isn't particularly relevant to generating a limited subset of valid names.
        jachee 7y ago
        Yeah, I misremembered the moral of this list. Ah well, my karmic price has been paid.
      - vxNsr 7y ago
        That's kinda the opposite side of this issue. No need to worry about it because the generator knows all the names, that listicle is about user-generated input.
    - lozf 7y ago
      hsxkpasswd[0] can do it with a little configuration[1]. [0]: https://github.com/bbusschots/hsxkpasswd https://github.com/bbusschots/hsxkpasswd [1]: https://www.bartbusschots.ie/s/2015/09/06/using-the-hsxkpasswd-terminal-command-part-2-of-2/ https://www.bartbusschots.ie/s/2015/09/06/using-the-hsxkpass...
- cabaalis 7y ago
  "jglksadh3498ygha# and don't accept 'random string of numbers and letters,' that is not me"
- rootusrootus 7y ago
  There is not really a good answer to social engineering, as far as I can tell. For example -- I do my banking with a big, reputable bank most everyone has heard of (and not one of the banks people like to hate) and I've got passwords, two factor authentication, etc. That's all great. And yet, about a year ago my wife's debit card got cloned at a compromised ATM and armed with that information (bank, and name) someone called up the customer service at my bank and asked them to reset the password to our account. According to a security investigation by the bank, it took them six attempts before they found someone who believed their sob story about being stuck in a hospital somewhere with no access to money, etc. Gave them our account login and reset our password for them. The person logged into the web site, transferred a bunch of money from savings into the compromised debit account and started pulling it out as fast as they could. I got instant notifications as they did it but was driving and didn't see them for about 20 minutes, by then the bank had deduced that something was wrong and shut it down, $5K later. Luckily the bank didn't really argue the point, they knew they were totally at fault for letting it happen, but still -- all the security in the world that I tried to use for that account and all it took was one bank employee to negate 100% of it.
  - ghaff 7y ago
    Of course, the alternative is that you are actually in a hospital with no access to money, etc. and the bank will unwaveringly stick to a policy that you must show up at a bank office with valid ID or you'll have to wait for a letter to your physical address of record, etc. Perhaps that's just the way it should go down in a case like this. But there are costs to making the decision to close off the potential for social engineering as thoroughly as possible.
    - rootusrootus 7y ago
      Agree there should be a way, perhaps, to recover from a bad situation. As a follow-up to my experience, I guess I should expand on the consequences for us. The bank admitted fault, but to protect themselves from a bad employee doing it again in the future, now when we call we have a special voice-only password and PIN, and we have to answer a battery of questions that are clearly pulled from a credit bureau (you know, the types of questions like "You had a mortgage in 2005, what was the street the property was on" and such things. Takes 10 minutes to get to "Thank you sir, how can I help you today" if we ever have to call customer service. Based on that experience, I think perhaps the bank should make that the answer to recover a deeply lost account. They gave a stranger the credentials to our account -- not just the password, but they had to tell them the login, and disable two-factor authentication (because the login is built from a PIN and RSA code) based on a plea for help. I can see forgetting your password, but who forgets everything? That should be a huge red flag. I could rant for a long time. I had a pointed discussion with a manager at the bank about how getting five repeated, fruitless requests to change credentials on an account didn't somehow trigger any protective response. How hard would it be to implement a counter that says "okay, after the second attempt to gain access by voice to an account that is denied for lack of authentication, all future calls for this account go directly to the security department for personal attention"? I got no good answer other than a lot of "yes sir, this was completely wrong, sir, I'm sorry, sir" etc.

"Oh, yeah... I found that question ridiculous, so I entered some garbage. Anyways, her real name is Smith, if that helps." Social Engineering.

onion2k 7y ago
Presumably the answer to that is to use a long but plausible random string that sounds like a posh English name like "Saint-John Winsor-Rothschild"
- SketchySeaBeast 7y ago
  That sounds like the right solution to me - it's the "correct horse battery staple" of this problem. I'm going to start using this. 4 names all put together - pronounceable over the phone, visibly viable, and uniquely generated for each instance.
  - fuzz4lyfe 7y ago
    Perhaps something like this? Q: "What is your mothers maiden name?" A: "Do not provide access under any circumstances unless this exact key is provided: WEWQEWQ321312"
    - SketchySeaBeast 7y ago
      But that doesn't give me an opportunity to say "Mrs. Sebastian Winifred Campershamp".
      - jschwartzi 7y ago
        There are some quirky name generators elsewhere on the internet. Perhaps you could mash some of the firstname lastname combinations together?
        SketchySeaBeast 7y ago
        That's my thought. Now we need to get a KeePass extension that does that. It'd be even better if it generated where you went to high school and your first pet's name as well. Though that too could be Mrs. Sebastian Winifred Campershamp.
        lozf 7y ago
        > Mrs. Sebastian Winifred Campershamp Definitely more plausible as a pets' name than a maiden name. </pedant>
        jschwartzi 7y ago
        This is a very Corgi name.
    - jodrellblank 7y ago
      muffled voice with strong accent, from call center, over long distance VOIP line which should be perfect clarity but mysteriously isn't, loud background noises, crackles "Sorry I did not hear, but there seems to be a problem with our computer system I am getting an error message instead of a name, please can you call back later". Screen shows them: "Do not provide access und" 25 character silent truncation.
- noirbot 7y ago
  Now I want someone to make a password generator that's just fancy hyphenated names. I can't imagine it would be too hard to make.
  - jachee 7y ago
    Just beware the Falsehoods Programmers Believe about Names: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
    - resoluteteeth 7y ago
      This isn't particularly relevant to generating a limited subset of valid names.
      - jachee 7y ago
        Yeah, I misremembered the moral of this list. Ah well, my karmic price has been paid.
    - vxNsr 7y ago
      That's kinda the opposite side of this issue. No need to worry about it because the generator knows all the names, that listicle is about user-generated input.
  - lozf 7y ago
    hsxkpasswd[0] can do it with a little configuration[1]. [0]: https://github.com/bbusschots/hsxkpasswd https://github.com/bbusschots/hsxkpasswd [1]: https://www.bartbusschots.ie/s/2015/09/06/using-the-hsxkpasswd-terminal-command-part-2-of-2/ https://www.bartbusschots.ie/s/2015/09/06/using-the-hsxkpass...
cabaalis 7y ago
"jglksadh3498ygha# and don't accept 'random string of numbers and letters,' that is not me"
rootusrootus 7y ago
There is not really a good answer to social engineering, as far as I can tell. For example -- I do my banking with a big, reputable bank most everyone has heard of (and not one of the banks people like to hate) and I've got passwords, two factor authentication, etc. That's all great. And yet, about a year ago my wife's debit card got cloned at a compromised ATM and armed with that information (bank, and name) someone called up the customer service at my bank and asked them to reset the password to our account. According to a security investigation by the bank, it took them six attempts before they found someone who believed their sob story about being stuck in a hospital somewhere with no access to money, etc. Gave them our account login and reset our password for them. The person logged into the web site, transferred a bunch of money from savings into the compromised debit account and started pulling it out as fast as they could. I got instant notifications as they did it but was driving and didn't see them for about 20 minutes, by then the bank had deduced that something was wrong and shut it down, $5K later. Luckily the bank didn't really argue the point, they knew they were totally at fault for letting it happen, but still -- all the security in the world that I tried to use for that account and all it took was one bank employee to negate 100% of it.
- ghaff 7y ago
  Of course, the alternative is that you are actually in a hospital with no access to money, etc. and the bank will unwaveringly stick to a policy that you must show up at a bank office with valid ID or you'll have to wait for a letter to your physical address of record, etc. Perhaps that's just the way it should go down in a case like this. But there are costs to making the decision to close off the potential for social engineering as thoroughly as possible.
  - rootusrootus 7y ago
    Agree there should be a way, perhaps, to recover from a bad situation. As a follow-up to my experience, I guess I should expand on the consequences for us. The bank admitted fault, but to protect themselves from a bad employee doing it again in the future, now when we call we have a special voice-only password and PIN, and we have to answer a battery of questions that are clearly pulled from a credit bureau (you know, the types of questions like "You had a mortgage in 2005, what was the street the property was on" and such things. Takes 10 minutes to get to "Thank you sir, how can I help you today" if we ever have to call customer service. Based on that experience, I think perhaps the bank should make that the answer to recover a deeply lost account. They gave a stranger the credentials to our account -- not just the password, but they had to tell them the login, and disable two-factor authentication (because the login is built from a PIN and RSA code) based on a plea for help. I can see forgetting your password, but who forgets everything? That should be a huge red flag. I could rant for a long time. I had a pointed discussion with a manager at the bank about how getting five repeated, fruitless requests to change credentials on an account didn't somehow trigger any protective response. How hard would it be to implement a counter that says "okay, after the second attempt to gain access by voice to an account that is denied for lack of authentication, all future calls for this account go directly to the security department for personal attention"? I got no good answer other than a lot of "yes sir, this was completely wrong, sir, I'm sorry, sir" etc.