4 ms·

I think I have a 0% success rate with secret questions. They always ask things that don't apply to me, so I have to make them up. Then I forget them. (Sorry,

I think I have a 0% success rate with secret questions. They always ask things that don't apply to me, so I have to make them up. Then I forget them. (Sorry, Charles Schwab, I've never owned a car.) I have learned the hard way that these are just easy-to-guess extra passwords that let attackers bypass my hard-to-guess password. I dump them in my password manager so I don't get locked out, but I know they're a ticking security time bomb. Every site asks the same questions, so if the database gets compromised, it lets someone compromise other accounts. And, they're probably not even one-way-hashed, because customer service people ask for them on the phone and can probably see the answers. I don't even know how it's legal to use these things anymore. They set the field of information security back two decades. (I have always assumed that they exist to save money on call centers. You get locked out, you have to talk to a real person, and real people want salary and benefits. But with the abysmal success rate that the paper shows, I'm not even sure it's saving people money. It just seems wrong on every level. For that reason, I know they're here to stay for good.)

TheAdamAndChe 6y ago
If you use a password manager, then its easy to make and save secure answers. Question: what is the name of your first car's cousin? Answer: rnrogbpqhey..!105
- dzdt 6y ago
  Sorry your reply must be a maximum of 12 characters. Punctuation is not allowed.
  - monocasa 6y ago
    And run through tolower() silently.
- mauli 6y ago
  For cases where the questions are used by automation, it's okay. Not so much when humans come into play, that can be social engineered: A friend called his bank for something. They verified his idenitiy, him answering to 'what was your first pet's name' with: The answer is random letters, numers and symbols. He was verified to be the owner, not having actually told the support person a single matching character. For those cases, generators for random answers that read legit would be better. I started putting in random word sentences like 'DoYouHaveAPetCalledPeter', stored in pwdstore metadata to the accounts.
  - joshvm 6y ago
    Also it's fun when you have to speak to customer support and you're not sure if you made up the answer or not. It's extra fun when the security question is something embarrassingly obvious like "what town did you grow up in?" or "what is your mother's maiden name?" and you get it wrong (and have to say "No really, I know this but I lied on your form").
stephen_cagle 6y ago
The good news is that you are very good at keeping secrets. :)

TheAdamAndChe 6y ago

If you use a password manager, then its easy to make and save secure answers. Question: what is the name of your first car's cousin? Answer: rnrogbpqhey..!105

dzdt 6y ago
Sorry your reply must be a maximum of 12 characters. Punctuation is not allowed.
- monocasa 6y ago
  And run through tolower() silently.
mauli 6y ago
For cases where the questions are used by automation, it's okay. Not so much when humans come into play, that can be social engineered: A friend called his bank for something. They verified his idenitiy, him answering to 'what was your first pet's name' with: The answer is random letters, numers and symbols. He was verified to be the owner, not having actually told the support person a single matching character. For those cases, generators for random answers that read legit would be better. I started putting in random word sentences like 'DoYouHaveAPetCalledPeter', stored in pwdstore metadata to the accounts.
- joshvm 6y ago
  Also it's fun when you have to speak to customer support and you're not sure if you made up the answer or not. It's extra fun when the security question is something embarrassingly obvious like "what town did you grow up in?" or "what is your mother's maiden name?" and you get it wrong (and have to say "No really, I know this but I lied on your form").

stephen_cagle 6y ago

The good news is that you are very good at keeping secrets. :)