4 ms·

> Because security questions are nuts! I mean those ones are extra nuts but in general the whole idea of taking either immutable pieces of data like your mother

by rtsil 4y ago

> Because security questions are nuts! I mean those ones are extra nuts but in general the whole idea of taking either immutable pieces of data like your mother's maiden name or enumerable questions like the make of your first car or transient ones like your favourite movie... I always use a randomly generated string with a high entropy as answer to the security question.

brnt 4y ago
I recall reading about someone restoring access over the phone who had forgotten that string. If memory serves, the service worker accepted "random string" as the correct answer. I wish U2F was much more widely accepted then it is.
- jve 4y ago
  Hey, I'm a yubikey user. I even have two as they recommend to have a backup. But I still can't get over myself to trust a digital piece of hardware that it will not fail me. And I still want to have some backup code printed or TOTP token (which itself is backed up) along with yubikey etc.
  - brnt 4y ago
    I have two U2F keys and too always register them both. Got an extra set coming with NFC, and I'll probably add them too. I share the same keys with my partner. But yeah, most services also hand you a set of recovery codes which serve as backup when hardware should fail. I've not actually have any hardware crap out on me yet though. I trust it far more than easily socially engineered "secret" questions or a phone 2F.
    - fmajid 4y ago
      I have 4 (3 Yubikeys, 1 Hypersecu HyperFIDO), and I ordered 6 more, some for my wife and others for offsite backup, sadly some services will only allow you to register two, and AWS only one for root accounts.
  - usea 4y ago
    Losing a second factor is an underappreciated threat. Adding 2fa can definitely increase the risk of losing an account, and a responsible person will weigh the costs and risks of doing so. You can reduce that risk, e.g. by keeping a piece of paper safe somewhere, but it's never gone entirely. What if your house burns down? Oh, a fire safe. What if that gets stolen? A safety deposit box, etc. Those all have their own risks and costs as well. It's completely reasonable to not add 2fa to your accounts, if you believe that your ability to keep safe a second factor is less than the chance of someone guessing your password. I have lost (/stolen/destroyed) more physical possessions than I have had accounts hacked. By a lot.
    - jve 4y ago
      Exactly: There are risks: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), kids, washing machines, etc. I really like how our country TLD registrar handles 2nd factor recovery: nic.lv. As long as I'm alive and myself, I can disable 2FA without my second factor. We have ubiquitous ID card which servers as passport. And it has smartcard there used to sign documents and communicate with gov/corp entities. If we lose 2nd factor, we can submit application, electronically signed, email it to request disabling 2FA. Or I can show up in person with my ID card/password and request disabling 2FA. What I now noticed is I can pay for my domain and in payment notes request disabling 2FA. This looks like a weak point - I wonder if they correlate WHO paid for that domain name. This obviously can't work for international services as they won't trust our ID card issuer. Otherwise piece of paper with backup codes are: 1) impossible to retrieve remotely 2) easily replicated and distributed
      - Nextgrid 4y ago
        > This obviously can't work for international services as they won't trust our ID card issuer. Why not? They don't need to trust the issuer to say "this certificate is X person", they just need the issuer to say "this certificate is the same person as this previous certificate" (presumably via distinguished name matching). As long as the issue vouches that it's the same person that initially registered the domain, it should be fine, regardless of whether the actual identity of the person is correct.
pletnes 4y ago
1Password has a feature for this now, I think it’s great. Insert and generate random strings for security questions. I’d consider using something you can read to someone on the phone if it’s a company you can call - banks, insurance, ISP, something that’s important to you.
deathanatos 4y ago
I once used a randomly generated word as the answer. But the darn thing required five security questions and answers, so of course I just reused the same answer (random, unrelated to the question) across all five. On fine day, I had to call in to the support for something or another. He's like "I need to ask for the answer to the security questions", I'm thinking "no problemo" and I kid you not, the agent asked all five questions. By the last I'm thinking "surely you can't think I'm going to miss this one?" Edit: it also reminds me of Rackspace! If you initiated a customer support request — for which the button was in the console, after logging in, the agent would ask the security question. The answer to which … was in the same console!
- cafeinux 4y ago
  My guess is that the call was recorded and the agent was required by security to always ask the 5 questions, and he was probably thinking "There's no point in asking those five questions since the answer is the same, but I'm not paid enough to risk being reprimanded just to save 10 seconds for the customer."
jedberg 4y ago
I used to do this until I had to do a security question on the phone and just said, "It's a string of random characters" and they accepted that. Now when I'm forced to use security questions, I use long but reasonable answers, ideally ones that aren't enumerable.
- b112 4y ago
  One time, I was in a weird mood when answering the question. So I wrote "I refuse to answer". There was no way to ever change it, so I always ended up with very confused call centre people, no matter how I explained it.
  - aendruk 4y ago
    I used to cross the US border frequently and kept snarky passwords on my laptop and phone, dreaming of the day I’d get to answer honestly with apparent noncompliance or some remark about the ethics of warrantless searches. Alas, I don’t fall into the demographics they tend to prey on.
- stavros 4y ago
  I use random strings as well and this was my fear, thanks for confirming it :(
- cam_l 4y ago
  It actually doesnt matter if there is a person on the other end of that line. I have forgotten many of these over the years. My go to was always, like oh I always put a random name or phrase or just mash the keyboard. They always ended up prompting me and I would give a few guesses, and if there is any way of them bypassing it, they would do it at that point. The only way to solve this is for them to not to have a way to bypass it.
pabs3 4y ago
I'd use diceware for that, in case you need to read it out over the phone.
aidos 4y ago
I’ve don’t do that- someone on HN pointed out that most agents will accept “it’s a random string” as the answer.
ted_bunny 4y ago
Now I know my go-to shot-in-the-dark guess when I'm socially engineering my way into your account.

by rtsil 4y ago

brnt 4y ago

I recall reading about someone restoring access over the phone who had forgotten that string. If memory serves, the service worker accepted "random string" as the correct answer. I wish U2F was much more widely accepted then it is.

jve 4y ago
Hey, I'm a yubikey user. I even have two as they recommend to have a backup. But I still can't get over myself to trust a digital piece of hardware that it will not fail me. And I still want to have some backup code printed or TOTP token (which itself is backed up) along with yubikey etc.
- brnt 4y ago
  I have two U2F keys and too always register them both. Got an extra set coming with NFC, and I'll probably add them too. I share the same keys with my partner. But yeah, most services also hand you a set of recovery codes which serve as backup when hardware should fail. I've not actually have any hardware crap out on me yet though. I trust it far more than easily socially engineered "secret" questions or a phone 2F.
  - fmajid 4y ago
    I have 4 (3 Yubikeys, 1 Hypersecu HyperFIDO), and I ordered 6 more, some for my wife and others for offsite backup, sadly some services will only allow you to register two, and AWS only one for root accounts.
- usea 4y ago
  Losing a second factor is an underappreciated threat. Adding 2fa can definitely increase the risk of losing an account, and a responsible person will weigh the costs and risks of doing so. You can reduce that risk, e.g. by keeping a piece of paper safe somewhere, but it's never gone entirely. What if your house burns down? Oh, a fire safe. What if that gets stolen? A safety deposit box, etc. Those all have their own risks and costs as well. It's completely reasonable to not add 2fa to your accounts, if you believe that your ability to keep safe a second factor is less than the chance of someone guessing your password. I have lost (/stolen/destroyed) more physical possessions than I have had accounts hacked. By a lot.
  - jve 4y ago
    Exactly: There are risks: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), kids, washing machines, etc. I really like how our country TLD registrar handles 2nd factor recovery: nic.lv. As long as I'm alive and myself, I can disable 2FA without my second factor. We have ubiquitous ID card which servers as passport. And it has smartcard there used to sign documents and communicate with gov/corp entities. If we lose 2nd factor, we can submit application, electronically signed, email it to request disabling 2FA. Or I can show up in person with my ID card/password and request disabling 2FA. What I now noticed is I can pay for my domain and in payment notes request disabling 2FA. This looks like a weak point - I wonder if they correlate WHO paid for that domain name. This obviously can't work for international services as they won't trust our ID card issuer. Otherwise piece of paper with backup codes are: 1) impossible to retrieve remotely 2) easily replicated and distributed
    - Nextgrid 4y ago
      > This obviously can't work for international services as they won't trust our ID card issuer. Why not? They don't need to trust the issuer to say "this certificate is X person", they just need the issuer to say "this certificate is the same person as this previous certificate" (presumably via distinguished name matching). As long as the issue vouches that it's the same person that initially registered the domain, it should be fine, regardless of whether the actual identity of the person is correct.

pletnes 4y ago

1Password has a feature for this now, I think it’s great. Insert and generate random strings for security questions. I’d consider using something you can read to someone on the phone if it’s a company you can call - banks, insurance, ISP, something that’s important to you.

deathanatos 4y ago

I once used a randomly generated word as the answer. But the darn thing required five security questions and answers, so of course I just reused the same answer (random, unrelated to the question) across all five. On fine day, I had to call in to the support for something or another. He's like "I need to ask for the answer to the security questions", I'm thinking "no problemo" and I kid you not, the agent asked all five questions. By the last I'm thinking "surely you can't think I'm going to miss this one?" Edit: it also reminds me of Rackspace! If you initiated a customer support request — for which the button was in the console, after logging in, the agent would ask the security question. The answer to which … was in the same console!

cafeinux 4y ago
My guess is that the call was recorded and the agent was required by security to always ask the 5 questions, and he was probably thinking "There's no point in asking those five questions since the answer is the same, but I'm not paid enough to risk being reprimanded just to save 10 seconds for the customer."

jedberg 4y ago

I used to do this until I had to do a security question on the phone and just said, "It's a string of random characters" and they accepted that. Now when I'm forced to use security questions, I use long but reasonable answers, ideally ones that aren't enumerable.

b112 4y ago
One time, I was in a weird mood when answering the question. So I wrote "I refuse to answer". There was no way to ever change it, so I always ended up with very confused call centre people, no matter how I explained it.
- aendruk 4y ago
  I used to cross the US border frequently and kept snarky passwords on my laptop and phone, dreaming of the day I’d get to answer honestly with apparent noncompliance or some remark about the ethics of warrantless searches. Alas, I don’t fall into the demographics they tend to prey on.
stavros 4y ago
I use random strings as well and this was my fear, thanks for confirming it :(
cam_l 4y ago
It actually doesnt matter if there is a person on the other end of that line. I have forgotten many of these over the years. My go to was always, like oh I always put a random name or phrase or just mash the keyboard. They always ended up prompting me and I would give a few guesses, and if there is any way of them bypassing it, they would do it at that point. The only way to solve this is for them to not to have a way to bypass it.

pabs3 4y ago

I'd use diceware for that, in case you need to read it out over the phone.

aidos 4y ago

I’ve don’t do that- someone on HN pointed out that most agents will accept “it’s a random string” as the answer.

ted_bunny 4y ago

Now I know my go-to shot-in-the-dark guess when I'm socially engineering my way into your account.