4 ms·

This is very, very, cool. But I am a little worried it's also a social engineer's wet dream. It'd be great to put everyone's birthday as January 1 of the year

This is very, very, cool. But I am a little worried it's also a social engineer's wet dream. It'd be great to put everyone's birthday as January 1 of the year they were born by default, and scrub things such as: * City names other than (maybe) the city they currently live in * Proper names e.g. first partners, spouses, pets (I have no idea how you'd do this though, other than warning users if one of the top 1000 names are detected in their explanatory text or something) * Names of vehicles Honestly with how varied security questions can be these days I hesitate to suggest there's even a "safe" list of personal facts which can be publicly displayed. Obviously whatever you might put on LinkedIn or a resume is fair game, but anything beyond that may really open you up to attacks.

alwayslikethis 2y ago
Not saying you should share your personal info on these charts, but you should never give real answers to security questions anyways. They are going to be easy to guess by definition, on top of revealing personal information to the vendor and any attackers. If you use a password generator (and thus you never reuse or forget passwords), the easiest thing to do is to just set it to the password (though they may be stored in plaintext), or a different password you keep on the notes in your password manager.
- 0xCMP 2y ago
  Still plenty of places have "shadow security questions" based on knowing the answers to some of these things already.
- yardstick 2y ago
  Definitely don’t set security questions to the password itself. Use the password generator to come up with some random words, different for each question.
  - alwayslikethis 2y ago
    While there is a concern about the plaintext answer leaking, I wouldn't think too much of it, since if the credentials db got compromised, I would assume the attackers also got everything else of value. Leaking the password at that point is no different than any other random string.
    - krupan 2y ago
      If they store the salted hash of your password but store the answers to security questions as plain text, then your advice is very bad. The db doesn't have to get pwned even, employees of the company will see it
- varenc 2y ago
  There’s certain identify verifications checks online that require you give the real answer. Things like pulling your own credit report. They already know places you’ve lived in or models of vehicles you’ve insured and ask you this to confirm your identity. So not just security questions where you can define the correct answer.
- mmahemoff 2y ago
  It shows how careless the industry is that these security questions persist. Sarah Palin’s Yahoo! account was handed by someone guessing easily accessible security questions. That was 17 years ago. When backward systems force you to answer these questions, I agree it’s better to generate a random string just for this question and provider. Plus it’s a fun time on the odd occasion these extra questions are required in a phone call. “To complete security, what was your first pet’s name?” “I’ll never forget dear PMM&7Qhdcim6WdJ:2XaviMw”
  - romeo88 2y ago
    Are you Elon Musk? :) But suriosly good advice.
  - gus_massa 2y ago
    To get an account back, once I got something like: > Which is your favotite food? > Please select your old answer: > 1) banana > 2) apple > 3) t5$2eoW > 4) pear
- krupan 2y ago
  DO NOT use your password for the answer to security questions! Yes, your answers should be stored securely, but there's a good chance they aren't. Use a different generated password, or bogus answers if you need to
- daveguy 2y ago
  Do not set it to the password. They might not be held as securely as the password. Use the additional fields/notes of your password generator and make them other generated random passwords.
- sersi 2y ago
  While I agree with you, in my experience it's important for the security answers to be pronunceable. Otherwise some CS will just wave them away as being gibberish. So I generate random answers but them modify it so that it's somewhat pronunceable. Also obviously don't use the actual password since they are stored in plaintext
  - tasuki 2y ago
    I'm also a fan of pronounceable passwords - I even have a script to generate them,[0] yes it decreases entropy a little. I don't store passwords on my phone, so I sometimes find myself retyping passwords, and I find these much easier to retype. [0]: https://github.com/tasuki/dotrc/blob/master/.bin/pronounceable https://github.com/tasuki/dotrc/blob/master/.bin/pronounceab...
    - alwayslikethis 2y ago
      Pronounceable passwords is what pwgen does. You might be surprised by how much entropy you lose, which is apparently around half: https://security.stackexchange.com/questions/72781/security-of-pronounceable-passwords https://security.stackexchange.com/questions/72781/security-...
andai 2y ago
It's almost as though we would benefit from running software on our own computers... I hope that one day we can finally achieve this ambitious dream.

alwayslikethis 2y ago

Not saying you should share your personal info on these charts, but you should never give real answers to security questions anyways. They are going to be easy to guess by definition, on top of revealing personal information to the vendor and any attackers. If you use a password generator (and thus you never reuse or forget passwords), the easiest thing to do is to just set it to the password (though they may be stored in plaintext), or a different password you keep on the notes in your password manager.

0xCMP 2y ago
Still plenty of places have "shadow security questions" based on knowing the answers to some of these things already.
yardstick 2y ago
Definitely don’t set security questions to the password itself. Use the password generator to come up with some random words, different for each question.
- alwayslikethis 2y ago
  While there is a concern about the plaintext answer leaking, I wouldn't think too much of it, since if the credentials db got compromised, I would assume the attackers also got everything else of value. Leaking the password at that point is no different than any other random string.
  - krupan 2y ago
    If they store the salted hash of your password but store the answers to security questions as plain text, then your advice is very bad. The db doesn't have to get pwned even, employees of the company will see it
varenc 2y ago
There’s certain identify verifications checks online that require you give the real answer. Things like pulling your own credit report. They already know places you’ve lived in or models of vehicles you’ve insured and ask you this to confirm your identity. So not just security questions where you can define the correct answer.
mmahemoff 2y ago
It shows how careless the industry is that these security questions persist. Sarah Palin’s Yahoo! account was handed by someone guessing easily accessible security questions. That was 17 years ago. When backward systems force you to answer these questions, I agree it’s better to generate a random string just for this question and provider. Plus it’s a fun time on the odd occasion these extra questions are required in a phone call. “To complete security, what was your first pet’s name?” “I’ll never forget dear PMM&7Qhdcim6WdJ:2XaviMw”
- romeo88 2y ago
  Are you Elon Musk? :) But suriosly good advice.
- gus_massa 2y ago
  To get an account back, once I got something like: > Which is your favotite food? > Please select your old answer: > 1) banana > 2) apple > 3) t5$2eoW > 4) pear
krupan 2y ago
DO NOT use your password for the answer to security questions! Yes, your answers should be stored securely, but there's a good chance they aren't. Use a different generated password, or bogus answers if you need to
daveguy 2y ago
Do not set it to the password. They might not be held as securely as the password. Use the additional fields/notes of your password generator and make them other generated random passwords.
sersi 2y ago
While I agree with you, in my experience it's important for the security answers to be pronunceable. Otherwise some CS will just wave them away as being gibberish. So I generate random answers but them modify it so that it's somewhat pronunceable. Also obviously don't use the actual password since they are stored in plaintext
- tasuki 2y ago
  I'm also a fan of pronounceable passwords - I even have a script to generate them,[0] yes it decreases entropy a little. I don't store passwords on my phone, so I sometimes find myself retyping passwords, and I find these much easier to retype. [0]: https://github.com/tasuki/dotrc/blob/master/.bin/pronounceable https://github.com/tasuki/dotrc/blob/master/.bin/pronounceab...
  - alwayslikethis 2y ago
    Pronounceable passwords is what pwgen does. You might be surprised by how much entropy you lose, which is apparently around half: https://security.stackexchange.com/questions/72781/security-of-pronounceable-passwords https://security.stackexchange.com/questions/72781/security-...

andai 2y ago

It's almost as though we would benefit from running software on our own computers... I hope that one day we can finally achieve this ambitious dream.