3 ms·
Shouldn't the answers be hashed? It shouldn't be any worse than it would be for a password (i.e.: it shouldn't reveal it).
by jimktrains2 16y ago
Shouldn't the answers be hashed? It shouldn't be any worse than it would be for a password (i.e.: it shouldn't reveal it).
- 16s 16y agoYes, but do you trust them to do that?
- _delirium 16y agoI've had banks ask me some of these questions over the phone as a verification measure, so I end up assuming that the answers are available to phone reps in the system somewhere. Possibly not true everywhere, but at various banks I've been asked over the phone for: mother's maiden name, my city of birth, and at Citibank, something labeled an "account password" that I had previously chosen online, and didn't realize I would end up having to spell out orally over the phone to a rep! (Fortunately it's not the same as the citibank.com login password... it seems to be a password used only for this purpose of phone verification... but still, getting people in the habit of being willing to spell a password out over the phone to a rep isn't encouraging great habits.)
- thwarted 16y agoEven worse is when they ask for authentication with a yes/no question based on something personal about the account. "Is your mother's maiden name Smith?" "Are the last four digits of your social security number 1234?".