7 ms·
Great, now I'm going to have to rename my dog.
by geocrasher 4y ago
Great, now I'm going to have to rename my dog.
- LudwigNagasena 4y agoI never pick a real answer to my security questions. It just seems pointlessly dangerous.
- LegitShady 4y agothey never know that i secretly use the name of my imaginary pet from grade 1 rather than my actual first pets name.
- 4ec0755f5522 4y agoI use random strings and store them in a Passwordsafe db. Ever since the Sony PSN hack which IIRC did include secret questions and answers. (I may be mistaken, but I do know it was absolutely the last time I gave a company true information for security questions).
- mokanfar 4y agoHow do you keep track of phony answers to security questions if they are different for each site? If it is the same phony answer for every site, it is not any safer to use real answers to the security questions.
- _zer0 4y agoI generate the password and stored them in my password manager under the notes. 1Password added functionality seemingly recently to add security questions and generate a random word string that I use these days.
- bergenty 4y agoI hate password managers. They sign you out way too often and god forbid you’re on another PC.
- mattl 4y agoHow often is way too often?
- _zer0 4y agoMy work provides me with a 1Password subscription (for both work personal use) that I take advantage of that is pretty good. I think they only require you to reauthenticate with your master password once every two weeks or something. I use a PIN, biometrics, or my Apple Watch to unlock it when it timeouts in between that two week period, and I've had no problems syncing between several of my devices.
- Aaron2222 4y ago1Password on my Mac lets me set it to never require re-authentication with my master password, though it does seem to keep switching back to 30 days.
- brokenmachine 4y agoYou can set how often they log you out, and I have a phone...
- kibwen 4y agoNote that you should not generate a random password like D27fX$0f7RyD for your security questions. These are designed to give to a human operator on the other end of a phone. If an attacker calls up the account recovery line, gets asked for a security question, and just says "heh, I think it was a string of random characters", there's a decent chance the human operator will let them into the account. As you say, use an actual word string (passphrase) generator, which is a bit less susceptible to this attack.
- MerelyMortal 4y agoYep, if you can choose the question, choose something like "What was your first pet's name?" and then make up something silly like "Mister Poopy Eyes" (a conceivable child-given pet name).
- jensvdh 4y agoYou store the answers in your password manager and treat them like passwords
- jrockway 4y agoYup. You pretty much have to do this. I love signing into my bank's bill payment system. "You appear to know your password and possess your second factor. But what's your favorite book? <all lowercase favorite book> WRONG YOUR FAVORITE BOOK IS ACTUALLY <starts with an uppercase book> NOW YOUR ACCOUNT IS LOCKED." Even if you're using real answers, you will be locked out of your account if you don't treat them like passwords. Eventually.
- xboxnolifes 4y agoWorse yet, real answers are just weaker passwords. Mother's maiden name? Childhood friend? Elementary / high school? For a targeted attack, against most people, this is very insecure in the all information online age. Nobody needs to know your 20 character password if they have your social media page.
- hprotagonist 4y agoin the notes field of the appropriate keepass entry.
- 867-5309 4y agomemorable symbols and the site name !%!%example.com%!%!
- banana_giraffe 4y agoI used to do something like this. I avoid it now, and use a pass phrase of a few words as answers to these questions, stored as a password. It was clear to me after I had to read such a security question answer over the phone to unlock an account the CSR was perfectly happy with "gibberish over the phone == gibberish in front of me", meaning my attempt to secure things made it less secure in the end.
- themagician 4y agoPick your three favorite movie characters for which there is a lot of information about them (name, town where they grew up, age, dog with a name, etc.). Rotate through these three. Append the name of the service. Dog's name? buddylastpass There will be no reuse, because for Facebook it would be buddyfacebook or dugfacebook, or something else… but you will always be able to guess it in three tries. A computer system doing some kind of pentest isn't going to parse out the "facebook" or "lastpass". A human might, but that's why you rotate through three names. At the point where you have a human targeting your account and actually thinking about your inputs you are probably !@#$ed anyway.
- acomjean 4y agoI have a small orange password book… oddly. If that gets stolen I think I’d be in big trouble. However it doesn’t have my email address in it. Answers to those inquisitions of a password reset nature are within.
- CamperBob2 4y agoanswer$(first-word-in-question)
- _zer0 4y agoSame. I use random passwords for any required security questions. It is funny when you call customer support and they ask you to verify a security question though.
- adamdecaf 4y agoHave you ever tried to see if they'd let you bypass the question? I've wondered if saying "it's a bunch of gibberish" could work.
- lazide 4y agoIn my experience, this usually works, especially with banks.
- _zer0 4y agoI haven't tried, but I am not on the phone with support much as I go to great lengths to avoid calling haha. The one time I had to verify my security question, I told the representative that its a long, random character string and they waited for me to open up my password manager to read it out to them.
- macintux 4y agoI've certainly heard people speculate that would be the case. I always just put together 2-3 words unrelated to the question, e.g. my first grade schoolteacher is "Antique Campfire".
- winphone1974 4y agoI've done something like this with my bank, I tell them it's a bunch of nonsense because the security question recovery is just a variation of a weak password so we'll need to validate me some other way. They always can
- andirk 4y agoI was on a first date and forgot my wallet so the first place we went was the bank. I had to repeat all my info 3x. I leveled with them and pointed to my date and said I need $100. They gave me the $100.
- hprotagonist 4y agoi use diceware. my mothers maiden name is sternness-ardently, and i am a proud graduate of blade-purge-satin-dash elementary! …apparently.
- sogen 4y agoblade-purge sounds like a good name for a metal band
- justsomehnguy 4y agoJust today we received an email with a password reset request from a person who: could not login into the customer portal because he lost/forgot the password could not perform the password recovery procedure because his answer for the security question is some nonsense like 'blade-purge-satin-dash' *shrug_emoji*
- TylerE 4y agoSometimes these questions are just asinine. I ran into one once that a 6 character minimum length for the answer.
- justsomehnguy 4y agoJust checked: 'Your favourite computer game?'. > I ran into one once that a 6 character minimum length for the answer This is a problem too, but at least it works if you manage to talk to a living person - even if you don't remember exactly how did you wrote something you can prove you know the answer for the security question. With 'cp359-qreor-534wej' as an answer you have no chance.
- bergenty 4y agoIt’s seems more dangerous to be in doubt about your answers to security questions
- winphone1974 4y agoI've had good results from refusing to play this security theatre.
- tomxor 4y agoI have sooo many pet and mother maiden names, but I can't remember any of them because they are all `openssl rand -hex 32`
- brenainn 4y agoYears ago for my university student account, you were allowed to provide the question. I figured I would never need to use it, so I set the question to "Dicks?". I was very immature and thought that was funny. A few years later after the semester break I forgot my password. I had to email IT to reset it, and they replied "Please provide the answer to your security question: Dicks?". And I had to reply "Yes no problem, the answer is Dicks". It was an awkward email exchange, but in my defence I had immediately remembered the answer so it served its purpose.
- timeon 4y agoWas expecting answer to be something like: Moby&Tracy.
- spike021 4y agoI just create a new imaginary dog.
- jph 4y agoMy first dog's name is Lassie, spelled LC_ALL=C < /dev/urandom tr -dc '[[:graph:]]' | head -c16
- vagab0nd 4y agoBetter yet, my second college girlfriend's name is spelled the same. So is the make and model of my third car.