6 ms·
This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readabl
by iinnPP 2y ago
This is a misunderstanding. The CS agent has access to a plaintext (security question) password that can be used under special circumstances. It must be readable to function.
- Ladyady 2y agoNice try, Toronto Hydro
- iinnPP 2y agoI made no such claim. I merely have knowledge of the exact system in question.
- hooverd 2y agoWhich really should not be the same!
- gruez 2y agoSource?
- iinnPP 2y agoWorked on the recent upgrade done in August.
- shakna 2y agoThere's several alternatives to such an insecure system. That simply isn't the right way to do it.
- jonpurdy 2y agoMy solution to security/recovery questions is to generate or make up ransom answers, and store the question/answer pair in the notes field of the entry in my password manager. This kills the “knowing things about you” vector of phishing and impersonation and make it as secure as any unique and random password.
- FredPret 2y ago"What's your mother's maiden name?" "42_red_banana_&"
- jszymborski 2y agoThis is why I choose random but plausible answers. "Mother's maiden name? Cruz-Valdez" "First Concert? Lil' Mermaid" "City you were born in? Ubuntu"
- TJSomething 2y agoThe way I usually do this is with the random article button on Wikipedia, until I find something that sounds plausible.
- _dark_matter_ 2y ago1password team, integrate this feature please
- chrisfinazzo 2y agoHow can you be sure that a targeted attack can't exfiltrate all available fields? For the record, I don't have a great answer to this either -- genuinely curious.
- umbra07 2y agoYou can't. I see that as a far lesser/more manageable risk than traditional security questions are though.
- ixoyefish 2y agoThis is the login password. It was an unintelligable text with non alphabet characters. Source: I posted that on reddit.
- iinnPP 2y agoThe easiest solution is to call them and ask why they have that password and why they can read it. They will verify everything I have already said.
- icambron 2y agoI don't see why the security question answer has to be stored in the clear. If you have to give it over the phone, the agent can type it into a form field that hashes it and compares, just like a password on the site.
- mc32 2y agoWhat city were you born in: “Millwaukee”. The agent would be able to tell it was Milwaukee, but if he or she typed “Milwaukee” it’d go “bzzzzt” just because the user typoed the input initially at set-up.
- 01HNNWZ0MV43FF 2y agoIt's still awful security. city of birth is public info
- mc32 2y agoIt’s just an example to illustrate a point. Coulda been “Starbux lovers” instead of “starstruck lovers”.
- kristopolous 2y agoBecause security question answer have high variability for the average user. They're asked say, what street they grew up on. Is it "S. Main St." "South Main", "south main", "south main street", etc... Security questions in general are terrible so don't take this as if it's in defense of them. My favorite are the presumptive ones that assume something like "Where did you meet your spouse?" Someone should just go over the top: "Who was the editor of your first successful novel?" "What investment did you make your first billion with?"
- malfist 2y agoMy bank's list of security questions are almost all about your children or your spouse. Other than two about your birth location and mother's maiden name, both easily found answers for someone