3 ms·
A way for a company I interact with infrequently to identify me over the phone. Pin codes and secret questions are easy to forget when they can literally go ye
by slg 6y ago
A way for a company I interact with infrequently to identify me over the phone. Pin codes and secret questions are easy to forget when they can literally go years without being used. What was my favorite movie when I setup my ISP account in 2016? This leads to customer service reps that are too forgiving and are easily susceptible to social engineering.
- mfontani 6y agoRandomize the answers to those things, and stick them in your password manager alongside (or separate from) the log-in information. Site asks for my mother maiden's name? Let me check "pwgen 18 1"... That'll be "Viquo4cai2gienoo2p".
- TeMPOraL 6y agoThat may be vulnerable to social engineering if the person on the other side accepts "I'm using a randomly generated string of letters" as an answer :). So if your password manager accepts user-provided passwords, I'd just string two or three random words together and use that as the maiden name.
- deleted 6y ago[deleted]
- xavierlint 6y agoNever understood those kind of "security" questions. Is the site really going to hand out access to my account if that question gets answered correctly? Also, some sites don't allow you to not set up one, so it's like forcing users to open up a new vector to be hacked.
- drzaiusapelord 6y agoCharles Schwab does this with voice recognition. It certainly works, but I'm guessing its cheaper to use these legacy systems.
- armincerf 6y agoYou'd think they would just use the same 2FA methods that are popular for logging in. 'We sent a notification, click accept on it to continue' or 'read the 6 digit authenticator code' would be re-useable for their web login and there are a ton of libraries and info that make it easy to implement.