Personal knowledge questions are just clear text passwords that can be determined from publicly available information. Apparently everyone gets that except the

Personal knowledge questions are just clear text passwords that can be determined from publicly available information. Apparently everyone gets that except the security people because they keep thinking it’s the best thing ever. It’s right up there with calling on the phone being a security factor - because yes everyone knows my voice so there is no possible way anyone can call and claim to be me. Synchrony financial still takes top honors for locking out my account when I use a vpn, and giving a menu of phone numbers from Transunion to choose where to send SMS auth attempts - you don’t even have to ask my phone provider to port my number to your phone, just fill out a raffle ticket at the mall and wait for it to turn up on the report. I can gripe about Google a lot but no denying they have done more then anyone to improve the security of the average user - TOTP, yubikey, per-device passwords for e-mail. Wish the banks would catch up.