6 ms·
This brings up some interesting technical questions: how long is too long and what is a deep question for identity?
by threatofrain 7y ago
This brings up some interesting technical questions: how long is too long and what is a deep question for identity?
- a3n 7y agoYour imaginary friend's mother's maiden name.
- blowski 7y agoWhich also happens to be an extremely rare maiden name - i.e. not Smith but "Vortangula" or "Brinderbass".
- pavel_lishin 7y ago> Vortangula Brinderbass Thank you for the new D&D character name.
- theshadowknows 7y agoOne time I did a "forgot password" reset on an old email account. Apparently young me thought it was a good idea to choose the 'pick your own question' thing and the question I chose was "What?" ...to this day I still don't remember what the answer was.
- dpeck 7y agoDepending on how young, there’s a decent chance the answer was some variation of “chicken butt”
- wkearney99 7y agoI have an 11 year old. You're sooo right about the chance that's it...
- theshadowknows 7y agoHah!
- criddell 7y agoI always give non-sense answers to security questions and store the question and answer in my password manager.
- chucksmash 7y agoThe dangers of being clever. Briefly used a given LastPass, used another setup for several years, then wanted to go back to that old LastPass for something. The LastPass password hint I'd set: > Don't forget your LastPass password. It wasn't some oblique hint. It was an FU from 20-something me to 30-something me that I distinctly remembered sending as soon as it saw it.
- theshadowknows 7y agoThat made me smile :)
- crayaz 7y agoI did that for my old college student self service account in 2004. The question was slightly better: "Who's yo daddy?" I couldn't guess who my daddy was in 2004. Wasn't my real dad nor was it me ¯\_(ツ)_/¯
- Groxx 7y agoSomething like a minute or two is probably the upper bound. Look at TOTP timers for a sane default (often like 30 seconds), and add a bit more for SMS delivery delays. You can always try to send a new code when the old one expires. But also: basically the entire security world has been recommending against SMS 2-factor for years, because it's so incredibly easy to steal access. Don't use SMS if at all possible, don't have it as a backup (because "a backup option" == "an option" == "you are only as strong as your weakest link"), etc. Avoid it entirely.