4 ms·
Vanguard also has traditional security questions too. So shit like "where were you born?".
by staticassertion 5y ago
Vanguard also has traditional security questions too. So shit like "where were you born?".
- bcraven 5y agoRemember that your answer to that need not necessarily be accurate. You can invent a 'security city' perhaps and always give that... or just give a randomly generated password that you store alongside in your password locker.
- OJFord 5y agoAnd if you use a long pseudo-randomly generating string, you will amuse support (and annoy yourself) when you have to read it all out... (Switched to correct-horse-battery-staple style for those after that.)
- InitialLastName 5y agoSupport Operator: We need to answer some security questions. To start with, what was your mother's maiden name? Scammer: "Oh, I just entered a long stream of random digits, but I can't find where I wrote it down" Operator: "Good enough. How large a credit line did you say you wanted?"
- OJFord 5y agoWhat happened in my case (password reset for the online account for a credit card) was rather: Operator: ... (Real) me: Err.. all of it? [hoping p,q,r-th characters will be enough] Operator: Yes please.
- staticassertion 5y agoFWIW, having gone through support with Vanguard, they didn't even acknowledge that they were random strings when I said they would be. They seemed well trained, at least the one I spoke with.
- staticassertion 5y agoI use a random string and store it in a password manager per-site.
- magicalhippo 5y agoI use KeePass, so I make it generate a long random string and just put that as the the answer. It has encrypted storage of additional name value pairs, so I can label each string with the appropriate question.
- r1ch 5y agoI suggest using diceware or similar random words, not random strings. Humans are typically processing these, not machines. "What's your mother's maiden name" can be answered by "Oh, I just put a bunch of random letters" if someone knows your stance on security questions.
- sk5t 5y agoYes! It should be much harder to convince a CSR who can see your plaintext answers that you're legit and don't know you were born in "Peoria" vs "eH2ochomheeVe6ti".
- magicalhippo 5y agoI admit I've only had to fall back to the "security questions" a few times, but I haven't had any issues with the random strings.
- monocularvision 5y agoThe point isn’t that you will have an issue using a random string, it’s that attackers who know you do so will be able to convince a customer service rep they are you by answering the question “I just put in some random keystrokes”
- magicalhippo 5y agoWell that would require fairly detailed knowledge about me, but point taken. Not sure how random words are much better though, if the person on the other side is ready to accept whatever.
- 5y ago