4 ms·
That's back to the "I use the same password on all sites" problem, which is essentially what he's doing - if he uses it on a site that's compromised, all of his
by tomkarlo 16y ago
That's back to the "I use the same password on all sites" problem, which is essentially what he's doing - if he uses it on a site that's compromised, all of his logins are now potentially exposed.
- michaelchisari 16y agoThat's true, although I do hash my answer with a domain-specific secret, I should have mentioned that. If at all possible, however, I don't fill out the secret question. There are actually a good amount of major sites that let you skip that step. I'd rather just be locked out if I forget the password, than have that be another vector for taking over the account.
- michaelcampbell 16y agoYes, absolutely. I was probably unclear; I wasn't trying to say it was a GOOD idea, just that it works.