5 ms·
Wait until you encounter some service like Yahoo Mail who absolutely refuse to change your password unless you remember the junk answers to the security questio
by Joakal 16y ago
Wait until you encounter some service like Yahoo Mail who absolutely refuse to change your password unless you remember the junk answers to the security questions. Even if I provided an alternate email contact, the security questions needed to be answered.
I stopped using them then.
- michaelcampbell 16y agoPresumably if it's a standard answer, he'll not have forgotten any of them.
- tomkarlo 16y agoThat's back to the "I use the same password on all sites" problem, which is essentially what he's doing - if he uses it on a site that's compromised, all of his logins are now potentially exposed.
- michaelchisari 16y agoThat's true, although I do hash my answer with a domain-specific secret, I should have mentioned that. If at all possible, however, I don't fill out the secret question. There are actually a good amount of major sites that let you skip that step. I'd rather just be locked out if I forget the password, than have that be another vector for taking over the account.
- michaelcampbell 16y agoYes, absolutely. I was probably unclear; I wasn't trying to say it was a GOOD idea, just that it works.