3 ms·
One mitigation is to make your mother's maiden name the output of: head -c 20 /dev/random | base64 And keep track of the result in your favorite password
by athenot 2y ago
One mitigation is to make your mother's maiden name the output of:
head -c 20 /dev/random | base64
And keep track of the result in your favorite password manager.
Fortunately, fewer and fewer orgs are using security questions, but there are still some important ones that only use that and no MFA.
- theluketaylor 2y agoThe problem with that plan is social engineering attacks. CSRs are often careless and will accept 'a bunch of random letters and numbers' as the answer rather than validating each character. Better to randomly select a long dictionary word or hypenate a few together. Equally unguessable but easily verified, so it won't be weakened during a phone conversation.