5 ms·

I think Secret Questions are even worse that described in the post. It creates a situation where one hacked web site can reveal critical personal information,

I think Secret Questions are even worse that described in the post. It creates a situation where one hacked web site can reveal critical personal information, such as mom's maiden name, that can be used across a range of sites and offline id theft vectors. I also deeply resent random ecommerce sites asking for personal information like the name of my dog or high school. My answer is always a random variation of "none of your damn business." This has caused me some problems when I do need to reset my password, but contacting support resolves it.

jimktrains2 16y ago
Shouldn't the answers be hashed? It shouldn't be any worse than it would be for a password (i.e.: it shouldn't reveal it).
- 16s 16y ago
  Yes, but do you trust them to do that?
- _delirium 16y ago
  I've had banks ask me some of these questions over the phone as a verification measure, so I end up assuming that the answers are available to phone reps in the system somewhere. Possibly not true everywhere, but at various banks I've been asked over the phone for: mother's maiden name, my city of birth, and at Citibank, something labeled an "account password" that I had previously chosen online, and didn't realize I would end up having to spell out orally over the phone to a rep! (Fortunately it's not the same as the citibank.com login password... it seems to be a password used only for this purpose of phone verification... but still, getting people in the habit of being willing to spell a password out over the phone to a rep isn't encouraging great habits.)
  - thwarted 16y ago
    Even worse is when they ask for authentication with a yes/no question based on something personal about the account. "Is your mother's maiden name Smith?" "Are the last four digits of your social security number 1234?".
qq66 16y ago
The name of your dog is "personal" information? Isn't it "dog-al" information? :)
joahua 16y ago
Random (keyboard mashing, random enough) works a charm - I've found that support often give puzzled sounds over the phone, before moving on to other forms of identification that render the secret question irrelevant. The exception is any website that doesn't require use of their prescribed questions.

jimktrains2 16y ago

Shouldn't the answers be hashed? It shouldn't be any worse than it would be for a password (i.e.: it shouldn't reveal it).

16s 16y ago
Yes, but do you trust them to do that?
_delirium 16y ago
I've had banks ask me some of these questions over the phone as a verification measure, so I end up assuming that the answers are available to phone reps in the system somewhere. Possibly not true everywhere, but at various banks I've been asked over the phone for: mother's maiden name, my city of birth, and at Citibank, something labeled an "account password" that I had previously chosen online, and didn't realize I would end up having to spell out orally over the phone to a rep! (Fortunately it's not the same as the citibank.com login password... it seems to be a password used only for this purpose of phone verification... but still, getting people in the habit of being willing to spell a password out over the phone to a rep isn't encouraging great habits.)
- thwarted 16y ago
  Even worse is when they ask for authentication with a yes/no question based on something personal about the account. "Is your mother's maiden name Smith?" "Are the last four digits of your social security number 1234?".

qq66 16y ago

The name of your dog is "personal" information? Isn't it "dog-al" information? :)

joahua 16y ago

Random (keyboard mashing, random enough) works a charm - I've found that support often give puzzled sounds over the phone, before moving on to other forms of identification that render the secret question irrelevant. The exception is any website that doesn't require use of their prescribed questions.