3 ms·
I always give a standard answer to every secret question that has nothing to do with the question being asked.
by michaelchisari 16y ago
I always give a standard answer to every secret question that has nothing to do with the question being asked.
- Joakal 16y agoWait until you encounter some service like Yahoo Mail who absolutely refuse to change your password unless you remember the junk answers to the security questions. Even if I provided an alternate email contact, the security questions needed to be answered. I stopped using them then.
- michaelcampbell 16y agoPresumably if it's a standard answer, he'll not have forgotten any of them.
- tomkarlo 16y agoThat's back to the "I use the same password on all sites" problem, which is essentially what he's doing - if he uses it on a site that's compromised, all of his logins are now potentially exposed.
- michaelchisari 16y agoThat's true, although I do hash my answer with a domain-specific secret, I should have mentioned that. If at all possible, however, I don't fill out the secret question. There are actually a good amount of major sites that let you skip that step. I'd rather just be locked out if I forget the password, than have that be another vector for taking over the account.
- michaelcampbell 16y agoYes, absolutely. I was probably unclear; I wasn't trying to say it was a GOOD idea, just that it works.
- cdr 16y agoI generate a random password-like string and store it in my password database.