8 ms·

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining about security questions a bunch): "Just got challenged with a security question, which was "Thank you for your loan application." Wtf, that is not a question. And I've never filled out any security questions for this website, so I have no idea what it's expecting me to enter. "I swear, security questions are out to get me."

ecoffey 14y ago
This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!
- unfletch 14y ago
  I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.
  - kijin 14y ago
    I can't imagine the horror of having to recite any password to an actual human being. What kind of company asks you to tell them your password by phone? "No, the backslash. The one that leans backwards, no, I mean, to the left. Above the Enter key." Surprise, the backslash is not above the Enter key on Canadian bilingual keyboards.
    - georgefox 14y ago
      I assume the support person is asking the security question, but the user entered his mother's maiden name as -K$%3{Tm,fsj$k8L or something similar.
      - prawn 14y ago
        No surprise to learn that she was quite keen to marry and be rid of it.
    - unfletch 14y ago
      What kind of company asks you to tell them your password by phone? I don't remember for sure. I think it was a utility company.
  - ecoffey 14y ago
    Heh, yeah luckily I haven't had to do that, but I have chosen some obscene answers to them, and then later had to recite, and spell them out to a horrified Indian call center worker.
    - namityadav 14y ago
      I see why you had to mention that the call center worker was "Indian". If you hadn't, your entire statement wouldn't have made any sense. Right?
      - shard 14y ago
        Well, the implied ethnicity of the poster is non-Indian, so in addition to the embarrassment of having to spell out obscene words, there's the cultural gap as well. The poster can't judge how offended the call center worker was, and probably feels like he's poorly representing his culture. I've had many similar experiences, especially since I've been living in Korea recently, and it's very uncomfortable not knowing exactly how big of a faux pas you committed.
        ecoffey 14y ago
        Yes I'm non-Indian, and that was just a way to indirectly reference my culture and language gap with him.
        namityadav 14y ago
        Makes sense. Thanks to both of you for taking the time to clarify.
      - prodigal_erik 14y ago
        Indian culture is pretty uptight in certain ways, and knowing that would make me feel a lot more guilty about making them uncomfortable. http://news.bbc.co.uk/2/hi/7871304.stm http://news.bbc.co.uk/2/hi/7871304.stm
      - ecoffey 14y ago
  - For_Iconoclasm 14y ago
    I use LastPass, but also use generated passwords to answer security questions. For these questions, one can enable the options for only using alphanumeric, unambiguous characters.
  - r00fus 14y ago
    It's a good point towards passphrases instead. 1Password gladly generates "pronounceable" passwords (e.g. "thax-lers-ponc-werv"). I usually think a bit about whether digits or symbols are required (some services and websites - Skype notably) don't like them. A 20-char passphrase with spaces, dashes, or character-based (e.g. "S") word-boundary delimiter is often good enough to provide excellent (80+ bits) entropy.
    - aidenn0 14y ago
      Even better is to generate real words. I took a "1000 most common english words" list and reduced it manually to 256 that don't rhyme with other common words and now use that to generate pass-phrases. It's my best solution for English since phonetic spelling isn't a feature of English.
    - TylerE 14y ago
      Or how about everybody that uses these fucking inane rules just do something sensible - like lock an account out if there are more than 5 failed logins in a row. Using a setup like that even "4321" is probably secure enough. Obviously use a secure hash on the backend as well.
      - yuliyp 14y ago
        OK, let's do that. How long do you lock it for? What if it's a common email address? How can the real owner unlock it?
      - jtheory 14y ago
        That's the trouble... the "sensible" options aren't so sensible when you really sit down and think about how they can be dodged, broken or abused. Imagine I'm trying to crack into your site, and you lock any account after 5 failed logins in a row. If I have access to (or can guess) a few thousand usernames, I can try the 4 most common passwords on all of those with no problems. I'll probably get some hits, no? Or heck, I can try the 5 most common passwords, and not only will I have a few hits, I'll also have plenty of time to dig around without any attention from you, because you'll be struggling with a massive customer service nightmare, as thousands of your customers find themselves all locked out the same morning.
  - dvhh 14y ago
    The point being : you shouldn't transmit your password to anyone in any way possible ( especially on the phone ). for more relevant info google "hunter2"
nextstep 14y ago
Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish to answer the questions honestly.
- FaceKicker 14y ago
  Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send me password reset links.
  - pbreit 14y ago
    You are mostly correct and thus it is generally safe to use accurate answers. But, sadly, I have seen some systems skip the email step.
  - nnnnnnnn 14y ago
    Yes, but if you compromise email then they become easily guessable password equivalents.
  - experiment0 14y ago
    AppleID's can be reset by knowing your email address, date of birth and normally 2 security questions.
  - skymt 14y ago
    In 2008 Sarah Palin's Yahoo! Mail account was broken into simply by looking up the answers to the security questions.
  - donpdonp 14y ago
jfasi 14y ago
My favorite thing is when the answer to the security question is allowed to be remembered by the browser, meaning anyone who gets my password can saunter up to any computer I've used in the past and bypass the stupid security question.
goatslacker 14y ago
Agreed. Shame to see so many reputable companies not give a rat's ass about security when they seriously prompt for security questions like "Where was your honeymoon?" or "What was your first car?" -- I've even seen "Where did you graduate High School?"
CGamesPlay 14y ago
Yes, but security questions are designed to protect against untargeted phishing. There is little than can be done to automatically help protect against targeted spearphishing attacks against a particular person.
desipenguin 14y ago
create a "secure note" in LastPass to store "exact" answer to security question(s)
impldefined 14y ago
It seems that no matter how many famous people have their accounts hacked by security questions, idiots will keep using them. Personally I always select a random question from the list and just paste my password there again.

ecoffey 14y ago

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

unfletch 14y ago
I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone: "...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..." Nightmare.
- kijin 14y ago
  I can't imagine the horror of having to recite any password to an actual human being. What kind of company asks you to tell them your password by phone? "No, the backslash. The one that leans backwards, no, I mean, to the left. Above the Enter key." Surprise, the backslash is not above the Enter key on Canadian bilingual keyboards.
  - georgefox 14y ago
    I assume the support person is asking the security question, but the user entered his mother's maiden name as -K$%3{Tm,fsj$k8L or something similar.
    - prawn 14y ago
      No surprise to learn that she was quite keen to marry and be rid of it.
  - unfletch 14y ago
    What kind of company asks you to tell them your password by phone? I don't remember for sure. I think it was a utility company.
- ecoffey 14y ago
  Heh, yeah luckily I haven't had to do that, but I have chosen some obscene answers to them, and then later had to recite, and spell them out to a horrified Indian call center worker.
  - namityadav 14y ago
    I see why you had to mention that the call center worker was "Indian". If you hadn't, your entire statement wouldn't have made any sense. Right?
    - shard 14y ago
      Well, the implied ethnicity of the poster is non-Indian, so in addition to the embarrassment of having to spell out obscene words, there's the cultural gap as well. The poster can't judge how offended the call center worker was, and probably feels like he's poorly representing his culture. I've had many similar experiences, especially since I've been living in Korea recently, and it's very uncomfortable not knowing exactly how big of a faux pas you committed.
      - ecoffey 14y ago
        Yes I'm non-Indian, and that was just a way to indirectly reference my culture and language gap with him.
        namityadav 14y ago
        Makes sense. Thanks to both of you for taking the time to clarify.
    - prodigal_erik 14y ago
      Indian culture is pretty uptight in certain ways, and knowing that would make me feel a lot more guilty about making them uncomfortable. http://news.bbc.co.uk/2/hi/7871304.stm http://news.bbc.co.uk/2/hi/7871304.stm
    - ecoffey 14y ago
- For_Iconoclasm 14y ago
  I use LastPass, but also use generated passwords to answer security questions. For these questions, one can enable the options for only using alphanumeric, unambiguous characters.
- r00fus 14y ago
  It's a good point towards passphrases instead. 1Password gladly generates "pronounceable" passwords (e.g. "thax-lers-ponc-werv"). I usually think a bit about whether digits or symbols are required (some services and websites - Skype notably) don't like them. A 20-char passphrase with spaces, dashes, or character-based (e.g. "S") word-boundary delimiter is often good enough to provide excellent (80+ bits) entropy.
  - aidenn0 14y ago
    Even better is to generate real words. I took a "1000 most common english words" list and reduced it manually to 256 that don't rhyme with other common words and now use that to generate pass-phrases. It's my best solution for English since phonetic spelling isn't a feature of English.
  - TylerE 14y ago
    Or how about everybody that uses these fucking inane rules just do something sensible - like lock an account out if there are more than 5 failed logins in a row. Using a setup like that even "4321" is probably secure enough. Obviously use a secure hash on the backend as well.
    - yuliyp 14y ago
      OK, let's do that. How long do you lock it for? What if it's a common email address? How can the real owner unlock it?
    - jtheory 14y ago
      That's the trouble... the "sensible" options aren't so sensible when you really sit down and think about how they can be dodged, broken or abused. Imagine I'm trying to crack into your site, and you lock any account after 5 failed logins in a row. If I have access to (or can guess) a few thousand usernames, I can try the 4 most common passwords on all of those with no problems. I'll probably get some hits, no? Or heck, I can try the 5 most common passwords, and not only will I have a few hits, I'll also have plenty of time to dig around without any attention from you, because you'll be struggling with a massive customer service nightmare, as thousands of your customers find themselves all locked out the same morning.
- dvhh 14y ago
  The point being : you shouldn't transmit your password to anyone in any way possible ( especially on the phone ). for more relevant info google "hunter2"

nextstep 14y ago

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish to answer the questions honestly.

FaceKicker 14y ago
Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send me password reset links.
- pbreit 14y ago
  You are mostly correct and thus it is generally safe to use accurate answers. But, sadly, I have seen some systems skip the email step.
- nnnnnnnn 14y ago
  Yes, but if you compromise email then they become easily guessable password equivalents.
- experiment0 14y ago
  AppleID's can be reset by knowing your email address, date of birth and normally 2 security questions.
- skymt 14y ago
  In 2008 Sarah Palin's Yahoo! Mail account was broken into simply by looking up the answers to the security questions.
- donpdonp 14y ago

jfasi 14y ago

My favorite thing is when the answer to the security question is allowed to be remembered by the browser, meaning anyone who gets my password can saunter up to any computer I've used in the past and bypass the stupid security question.

goatslacker 14y ago

Agreed. Shame to see so many reputable companies not give a rat's ass about security when they seriously prompt for security questions like "Where was your honeymoon?" or "What was your first car?" -- I've even seen "Where did you graduate High School?"

CGamesPlay 14y ago

Yes, but security questions are designed to protect against untargeted phishing. There is little than can be done to automatically help protect against targeted spearphishing attacks against a particular person.

desipenguin 14y ago

create a "secure note" in LastPass to store "exact" answer to security question(s)

impldefined 14y ago

It seems that no matter how many famous people have their accounts hacked by security questions, idiots will keep using them. Personally I always select a random question from the list and just paste my password there again.