7 ms·

This reminds me of account security questions. They ask things like "what's your childhood nickname", "what's your first pet's name". To my Chinese mother-in-la

This reminds me of account security questions. They ask things like "what's your childhood nickname", "what's your first pet's name". To my Chinese mother-in-law, who was born in the middle of the Cultural Revolution, when food was scarce, everyone was poor, education was not easy to get, government was non-functional due to anarchy, and when her first priority was to survive, all those questions are just weird. They reek of first-world assumptions.

est 6y ago
you are not supposed to type realistic answers to security questions. Its better to answer in complete unrelated ways so its not guesable
- architect01 6y ago
  but good luck remembering those guessed answers once you need them again to get your account back
  - 93po 6y ago
    I use a password generator for the answers and save them in my password manager. One time I had to read 20 random characters to someone on the phone as a response to my favorite food
    - recursive 6y ago
      So... why not just use your password manager to record the account's actual password, so you don't need to use security questions?
      - smsm42 6y ago
        Sometimes password can be reset without your asking so, or the system requires to supply both password and security questions.
      - fuzxi 6y ago
        A lot of sites require security questions (think banks and healthcare services).
        recursive 6y ago
        That doesn't seem to be a reason to record the garbage answer in a password manager.
        fuzxi 6y ago
        If you actually need to recover the account at some point, you might need the answers to the security questions.
- johnmaguire2013 6y ago
  I doubt a password manager to store the unrelated answers was a priority either.
- FooBarWidget 6y ago
  Good luck teaching my mother in law how to use a password manager. Heck, I tried teaching her to write down her passwords in a notebook, and she either keeps forgetting to write down, or she loses the notebook completely.
  - oli-g 6y ago
    I would be the same as your mother in law. Thankfully, my LastPass writes down my passwords for me and is impossible to lose physically.
- SCLeo 6y ago
  Then why are they framed as realistic questions? Sure, the most secure way of handling them might be what you suggested, but that is not how they designed to be answered. Security questions are created to verify your identity when password does not work (e.g. when they are forgotten). Answering them in unrelated ways just create another password that will also fail under the circumstances that security questions are needed.
  - orclev 6y ago
    The problem is that security questions are fundamentally flawed. Most of them are easily guessable with a little bit of research, and because they can often be used to bypass your password they're effectively a backdoor into your account. You're generally better off using them as either a backup password (that is, not guessable even given knowledge about you), or simply not using them at all. If you forgot your password then reset it via your e-mail account. In short, don't use security questions, they're fundamentally broken.
- reaperducer 6y ago
  you are not supposed to type realistic answers to security questions Assuming that you are allowed to type an answer. United Airlines makes you pick from a list of pre-selected answers. And some of the questions are easily worthless. For example, one of the United "security" questions is "What is your favorite ice cream?" How is someone who is lactose intolerant supposed to answer that? Or someone who has never had ice cream? Or someone who doesn't like any of the flavors on the list? My favorite ice cream today isn't the same as it was 20 years ago when I signed up for my frequent flyer card.
  - smsm42 6y ago
    United is probably the most idiotic of those. What's my favorite sport? Well, I'm not too much into sports but I'd say... Oh, it's not on the list. How about... Also not on the list. No wonder, there's hundreds of sports out there and United didn't pay their contractors enough to make a PhD level survey of sports. OK, baseball it is.
  - est 6y ago
    > What is your favorite ice cream Harvard University
- deathanatos 6y ago
  I actually did that once. The rest of the security practices were so ridiculous, I set all five security questions to the same nonsensical answer. I had to go through a security flow with a support rep. at some later point, and he's asked me all five questions, each time I'm giving him exactly the same answer, and by the fifth thinking, "Really? Do you think I somehow won't get this one?"
  - saagarjha 6y ago
    Sounds like a well trained representative?
    - deathanatos 6y ago
      Ha! That's a fair point. I'll award you with another security question story, then: I called into support. This was not my first call, but it was the first call where I was prompted for the security question by the rep. And, there was no mention that it was a security question, just "So deathanatos, what color is the dress?" (Not the actual question, of course.) I was like, "uh, what?" at which point the rep. mentioned it was the security question. I'm already logged in, so I dug around the account settings, and found that under there, the security questions and their answers were visible, so I rattled off the answer at that point. That particular method of support contact required you to log in, too, so anyone in contact could "answer" the security question by just looking it up…
wolco2 6y ago
She was so poor she couldn't get a nickname? If food was scarce like it was in the western world in the 30s people are more likely to remember a favourite food. My mother ate boiled onions everyday the one time she had a piece of bread would be extremely special and a memory to cherish. Those of us living in the western world now would have a harded time picking a fav food because there is so much choice. Your comment has a lot of first world assumptions about third world countries through the len of time without understanding your own history.

est 6y ago

you are not supposed to type realistic answers to security questions. Its better to answer in complete unrelated ways so its not guesable

architect01 6y ago
but good luck remembering those guessed answers once you need them again to get your account back
- 93po 6y ago
  I use a password generator for the answers and save them in my password manager. One time I had to read 20 random characters to someone on the phone as a response to my favorite food
  - recursive 6y ago
    So... why not just use your password manager to record the account's actual password, so you don't need to use security questions?
    - smsm42 6y ago
      Sometimes password can be reset without your asking so, or the system requires to supply both password and security questions.
    - fuzxi 6y ago
      A lot of sites require security questions (think banks and healthcare services).
      - recursive 6y ago
        That doesn't seem to be a reason to record the garbage answer in a password manager.
        fuzxi 6y ago
        If you actually need to recover the account at some point, you might need the answers to the security questions.
johnmaguire2013 6y ago
I doubt a password manager to store the unrelated answers was a priority either.
FooBarWidget 6y ago
Good luck teaching my mother in law how to use a password manager. Heck, I tried teaching her to write down her passwords in a notebook, and she either keeps forgetting to write down, or she loses the notebook completely.
- oli-g 6y ago
  I would be the same as your mother in law. Thankfully, my LastPass writes down my passwords for me and is impossible to lose physically.
SCLeo 6y ago
Then why are they framed as realistic questions? Sure, the most secure way of handling them might be what you suggested, but that is not how they designed to be answered. Security questions are created to verify your identity when password does not work (e.g. when they are forgotten). Answering them in unrelated ways just create another password that will also fail under the circumstances that security questions are needed.
- orclev 6y ago
  The problem is that security questions are fundamentally flawed. Most of them are easily guessable with a little bit of research, and because they can often be used to bypass your password they're effectively a backdoor into your account. You're generally better off using them as either a backup password (that is, not guessable even given knowledge about you), or simply not using them at all. If you forgot your password then reset it via your e-mail account. In short, don't use security questions, they're fundamentally broken.
reaperducer 6y ago
you are not supposed to type realistic answers to security questions Assuming that you are allowed to type an answer. United Airlines makes you pick from a list of pre-selected answers. And some of the questions are easily worthless. For example, one of the United "security" questions is "What is your favorite ice cream?" How is someone who is lactose intolerant supposed to answer that? Or someone who has never had ice cream? Or someone who doesn't like any of the flavors on the list? My favorite ice cream today isn't the same as it was 20 years ago when I signed up for my frequent flyer card.
- smsm42 6y ago
  United is probably the most idiotic of those. What's my favorite sport? Well, I'm not too much into sports but I'd say... Oh, it's not on the list. How about... Also not on the list. No wonder, there's hundreds of sports out there and United didn't pay their contractors enough to make a PhD level survey of sports. OK, baseball it is.
- est 6y ago
  > What is your favorite ice cream Harvard University
deathanatos 6y ago
I actually did that once. The rest of the security practices were so ridiculous, I set all five security questions to the same nonsensical answer. I had to go through a security flow with a support rep. at some later point, and he's asked me all five questions, each time I'm giving him exactly the same answer, and by the fifth thinking, "Really? Do you think I somehow won't get this one?"
- saagarjha 6y ago
  Sounds like a well trained representative?
  - deathanatos 6y ago
    Ha! That's a fair point. I'll award you with another security question story, then: I called into support. This was not my first call, but it was the first call where I was prompted for the security question by the rep. And, there was no mention that it was a security question, just "So deathanatos, what color is the dress?" (Not the actual question, of course.) I was like, "uh, what?" at which point the rep. mentioned it was the security question. I'm already logged in, so I dug around the account settings, and found that under there, the security questions and their answers were visible, so I rattled off the answer at that point. That particular method of support contact required you to log in, too, so anyone in contact could "answer" the security question by just looking it up…

wolco2 6y ago

She was so poor she couldn't get a nickname? If food was scarce like it was in the western world in the 30s people are more likely to remember a favourite food. My mother ate boiled onions everyday the one time she had a piece of bread would be extremely special and a memory to cherish. Those of us living in the western world now would have a harded time picking a fav food because there is so much choice. Your comment has a lot of first world assumptions about third world countries through the len of time without understanding your own history.