3 ms·

> and their secret questions and answers Periodic reminder that these are just passwords too. They should be treated as such by users (generate random response

by teeray 3y ago

> and their secret questions and answers Periodic reminder that these are just passwords too. They should be treated as such by users (generate random responses) and devs (hash and salt them).

gruez 3y ago
>They should be treated as such by users (generate random responses) and devs (hash and salt them). I agree for tech savvy users it's prudent to treat them as passwords, but it doesn't extend to the general public. If they should be treated as passwords, what's the point of having them then? They're most often used in password reset flows. If it's a random string/phrase, they're basically useless in that use case. In what situation would you have the randomly chosen string for the security question, but not the randomly chosen string for the password?
- renewiltord 3y ago
  They're just recovery codes by a different name and with a built-in hint. I could reset the password of half of my friends from what I know. For a random person, I could probably just use something like this https://www.fastbackgroundcheck.com/people/gavin-newsom/san-francisco-ca https://www.fastbackgroundcheck.com/people/gavin-newsom/san-... and get almost all the way there. As a user, if you want guessable recovery codes, that's fine. It's all in the threat model. The password for this account is very guessable. It used to be 000000. I don't care about any possible threat to it.
  - eli 3y ago
    I don't think most users care much one way or the other. But they do sometimes lose their credentials and need a password reset and if the reset flow assumes you'll be able to answer those questions anyway, you're going to have a bad time.
    - ghaff 3y ago
      In general, you don't want a forgotten password to be a "sucks to be you" situation or even a come to a physical office with two forms of ID situation.
- teeray 3y ago
  > What's the point of having them then? Their purpose these days is to provide a way for anyone to reset your account credentials using public information or the answers to Facebook quizes to find out your secret pirate name.
- JohnFen 3y ago
  For people who want to retain the convenience, my suggestion is twofold: 1) Don't answer the question that was asked. Mentally translate it to a different question entirely. "Name of first pet" is always answered as "color of first car", for instance. 2) Make the answers full sentences, not just single words. If the answer you're providing is "color of first car", the answer shouldn't be "white", it should be "The color of my first car was white".
  - heax 3y ago
    Just give your pet a random 4096 Bit string as name and your safe, no need to add unneeded complexity.
    - tzs 3y ago
      There are a couple problems with that approach. 1. That is likely to exceed the maximum length allowed for the form fields you have to use to enter it on web pages or in apps. You might find that on the page where you initially set it up the page silently truncated it to say 1000 bits, and that's what got stored on the server. But the page where you need to use it for password recovery handles 1500 bits, and the form in their app only handles 500. So you cannot get it to work in the app no matter what, and can only use it on the recovery page if you somehow figure out that only 1000 bits are on the server and truncate to that yourself. 2. Some places use the same security questions when you phone support. The support person asks you one of the security questions and can read the answer from the database. They compare that to what you tell them over the phone. You probably don't want to go through that with a random 4096 bit string.
      - JohnFen 3y ago
        > Some places use the same security questions when you phone support. Fascinating. This is something I never encountered, so it never occurred to me that this might be done.
        willcipriano 3y ago
- dfxm12 3y ago
  The point is, if you're answering these honestly, if an attacker knows your mother maiden's name and which hospital you were born in from attacking Comcast, now they can use this info to reset your bank password. If you had different answers on these different services, attackers are still at square one in terms of getting your bank info. Honestly, I don't know if there's a point to having these questions. At least one security expert feels similarly: https://www.schneier.com/essays/archives/2005/02/the_curse_of_the_sec.html https://www.schneier.com/essays/archives/2005/02/the_curse_o...
- 12_throw_away 3y ago
  > what's the point of having them then? None for the end user! (Although I assume there must be some corporate career incentives or something for implementing security theater like this, since they keep doing it anyway.)
bri3d 3y ago
> Periodic reminder that these are just passwords too. They should be treated as such by users (generate random responses) and devs (hash and salt them). Unfortunately this is not how almost any business treats them; they are frequently used as challenge/response authentication over the phone, so using a random response or hashing and salting them doesn't work. Authenticating a user over the phone is a major unsolved problem IMO, and responsible for a huge swath of modern account takeover issues.
washadjeffmad 3y ago
I usually recommend disregarding the questions and filling in a common response for every field (with the current date or the name of the company or service, for instance), and writing it down. No one except hackers or certain federal agencies would be able to compare the results of security questions across independent identity management systems.
- deleted 3y ago
  [deleted]
Rowlandjane 3y ago
[dead]

by teeray 3y ago

> and their secret questions and answers Periodic reminder that these are just passwords too. They should be treated as such by users (generate random responses) and devs (hash and salt them).

gruez 3y ago

>They should be treated as such by users (generate random responses) and devs (hash and salt them). I agree for tech savvy users it's prudent to treat them as passwords, but it doesn't extend to the general public. If they should be treated as passwords, what's the point of having them then? They're most often used in password reset flows. If it's a random string/phrase, they're basically useless in that use case. In what situation would you have the randomly chosen string for the security question, but not the randomly chosen string for the password?

renewiltord 3y ago
They're just recovery codes by a different name and with a built-in hint. I could reset the password of half of my friends from what I know. For a random person, I could probably just use something like this https://www.fastbackgroundcheck.com/people/gavin-newsom/san-francisco-ca https://www.fastbackgroundcheck.com/people/gavin-newsom/san-... and get almost all the way there. As a user, if you want guessable recovery codes, that's fine. It's all in the threat model. The password for this account is very guessable. It used to be 000000. I don't care about any possible threat to it.
- eli 3y ago
  I don't think most users care much one way or the other. But they do sometimes lose their credentials and need a password reset and if the reset flow assumes you'll be able to answer those questions anyway, you're going to have a bad time.
  - ghaff 3y ago
    In general, you don't want a forgotten password to be a "sucks to be you" situation or even a come to a physical office with two forms of ID situation.
teeray 3y ago
> What's the point of having them then? Their purpose these days is to provide a way for anyone to reset your account credentials using public information or the answers to Facebook quizes to find out your secret pirate name.
JohnFen 3y ago
For people who want to retain the convenience, my suggestion is twofold: 1) Don't answer the question that was asked. Mentally translate it to a different question entirely. "Name of first pet" is always answered as "color of first car", for instance. 2) Make the answers full sentences, not just single words. If the answer you're providing is "color of first car", the answer shouldn't be "white", it should be "The color of my first car was white".
- heax 3y ago
  Just give your pet a random 4096 Bit string as name and your safe, no need to add unneeded complexity.
  - tzs 3y ago
    There are a couple problems with that approach. 1. That is likely to exceed the maximum length allowed for the form fields you have to use to enter it on web pages or in apps. You might find that on the page where you initially set it up the page silently truncated it to say 1000 bits, and that's what got stored on the server. But the page where you need to use it for password recovery handles 1500 bits, and the form in their app only handles 500. So you cannot get it to work in the app no matter what, and can only use it on the recovery page if you somehow figure out that only 1000 bits are on the server and truncate to that yourself. 2. Some places use the same security questions when you phone support. The support person asks you one of the security questions and can read the answer from the database. They compare that to what you tell them over the phone. You probably don't want to go through that with a random 4096 bit string.
    - JohnFen 3y ago
      > Some places use the same security questions when you phone support. Fascinating. This is something I never encountered, so it never occurred to me that this might be done.
      - willcipriano 3y ago
dfxm12 3y ago
The point is, if you're answering these honestly, if an attacker knows your mother maiden's name and which hospital you were born in from attacking Comcast, now they can use this info to reset your bank password. If you had different answers on these different services, attackers are still at square one in terms of getting your bank info. Honestly, I don't know if there's a point to having these questions. At least one security expert feels similarly: https://www.schneier.com/essays/archives/2005/02/the_curse_of_the_sec.html https://www.schneier.com/essays/archives/2005/02/the_curse_o...
12_throw_away 3y ago
> what's the point of having them then? None for the end user! (Although I assume there must be some corporate career incentives or something for implementing security theater like this, since they keep doing it anyway.)

bri3d 3y ago

> Periodic reminder that these are just passwords too. They should be treated as such by users (generate random responses) and devs (hash and salt them). Unfortunately this is not how almost any business treats them; they are frequently used as challenge/response authentication over the phone, so using a random response or hashing and salting them doesn't work. Authenticating a user over the phone is a major unsolved problem IMO, and responsible for a huge swath of modern account takeover issues.

washadjeffmad 3y ago

I usually recommend disregarding the questions and filling in a common response for every field (with the current date or the name of the company or service, for instance), and writing it down. No one except hackers or certain federal agencies would be able to compare the results of security questions across independent identity management systems.

deleted 3y ago
[deleted]

Rowlandjane 3y ago

[dead]