3 ms·
What drives me crazy is that it doesn't matter how well I design my passwords if companies immediately sabotage them with their laughable "security" questions.
by SiVal 5y ago
What drives me crazy is that it doesn't matter how well I design my passwords if companies immediately sabotage them with their laughable "security" questions. "Pick one of these security questions carefully chosen for you by our marketing director's 4th grader: What was Mommy's maiden name? What was your first pet's name?..."
So now a hacker can just claim to have forgotten my password, google for the town I grew up in or mother's maiden name or try a list of the top 100 pet names, and not have to deal with my billion-year clever password at all. So they allow you to harden the front door's security as much as you like but require you to pick one of their six easy-access window designs for the side of the house just in case you (or anyone else) are unable to get through the front door.
I can improve security by providing the wrong answer, but then I'll have to record it and won't remember it if surprised by a challenge (on the phone for example). What I always want is the option to create my own security question, because I can design one that only makes sense to me but that I can reliably answer from memory.
- Nekit1234007 5y agoI just put passwords in those fields if they are required.
- yoz-y 5y agoSame, you can generate passwords as answers and save them in a password manager note or something.
- alain_gilbert 5y agoI read somewhere that a hacker called support, and when they asked the security questions, he said: "I remember just putting any gibberish in there." And voila, support person opens the door for you.
- devonkim 5y agoYeah, confirming that I did this to myself and realized in horror that anyone could have reset my password. So the only other option I see is to use real words that look plausible for the fields or to type in a message for support like “read this exactly letter for lettr”
- eloeffler 5y agoI did that (provide a false answer) with a yahoo mail account and got myself locked out forever... when they introduced the security questions it was a measure to double check when changing the password. as i was using a password manager i just provided nonsense and didn't store it anywhere. years later yahoo decided to make it mandatory to enter the security question when logging in from a new device. no chance to get in there anymore...