6 ms·

Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-questi

Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?

bithive123 14y ago
I think a good balance between usability and security is to normalize the answer (discard case, punctuation, etc) and then hash it.
- pestaa 14y ago
  My favorite security answer is "@#¤ß$ä#$&%^$" so please don't discard case or punctuation. (Yes, I design these answers virtually impossible to brute-force even for myself.)
  - cookiecaper 14y ago
    I too use a random and unique Secret Answer each time I am prompted for one. The Rackspace people, who require the account's SQ/SA before they push you through to the real support people, think I'm weird.
    - gizzlon 14y ago
      I just mash my keyboard for 10 seconds if I have to supply one. But now I wonder if "A bunch of random characters" would be accepted as the answer.. >(
tterrace 14y ago
I've called before to recover an account and the tech support guy asked for the answer to my security question.
elithrar 14y ago
> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext? I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).
- duaneb 14y ago
  They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.
  - danso 14y ago
    Well, that would be thhe reason, I think... Example: For: "Who was your favorite high school teacher." - Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood
    - dhimes 14y ago
      Of course, your answer should NEVER match the question. But that's beside the point. "Whose was your favorite high school teacher?" -Pecan pie.
      - untog 14y ago
        The point still stands, though. There is way, way too much potential variation to hash that stuff.
        Steko 14y ago
        I think the bigger point is that a ton of signups use this question. Whether you say 'Mr. Smith' or 'Pecan Pie' isn't going to save you if you use it for all of them.
dkokelley 14y ago
Possibly. I've been on phone support with companies that require me to tell them answers to my security questions. Also, automatic security question checking would require support for soft matches like capitalization or punctuation. You could simplify the data before hashing (strip special chars and convert to lower case), or store multiple hashes to each variant. I really wish a lot more work went in to security question penetration testing. It's relatively easy for a determined attacker to come up with the correct answers to these questions (or convince a human that they know the answers). The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication.
- wlievens 14y ago
  > The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication. Isn't that how the Sarah Palin thing happened?
  - dkokelley 14y ago
    Yes. That's exactly the incident I was thinking of.

Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?

bithive123 14y ago

I think a good balance between usability and security is to normalize the answer (discard case, punctuation, etc) and then hash it.

pestaa 14y ago
My favorite security answer is "@#¤ß$ä#$&%^$" so please don't discard case or punctuation. (Yes, I design these answers virtually impossible to brute-force even for myself.)
- cookiecaper 14y ago
  I too use a random and unique Secret Answer each time I am prompted for one. The Rackspace people, who require the account's SQ/SA before they push you through to the real support people, think I'm weird.
  - gizzlon 14y ago
    I just mash my keyboard for 10 seconds if I have to supply one. But now I wonder if "A bunch of random characters" would be accepted as the answer.. >(

tterrace 14y ago

I've called before to recover an account and the tech support guy asked for the answer to my security question.

elithrar 14y ago

> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext? I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).

duaneb 14y ago
They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.
- danso 14y ago
  Well, that would be thhe reason, I think... Example: For: "Who was your favorite high school teacher." - Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood
  - dhimes 14y ago
    Of course, your answer should NEVER match the question. But that's beside the point. "Whose was your favorite high school teacher?" -Pecan pie.
    - untog 14y ago
      The point still stands, though. There is way, way too much potential variation to hash that stuff.
      - Steko 14y ago
        I think the bigger point is that a ton of signups use this question. Whether you say 'Mr. Smith' or 'Pecan Pie' isn't going to save you if you use it for all of them.

dkokelley 14y ago

Possibly. I've been on phone support with companies that require me to tell them answers to my security questions. Also, automatic security question checking would require support for soft matches like capitalization or punctuation. You could simplify the data before hashing (strip special chars and convert to lower case), or store multiple hashes to each variant. I really wish a lot more work went in to security question penetration testing. It's relatively easy for a determined attacker to come up with the correct answers to these questions (or convince a human that they know the answers). The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication.

wlievens 14y ago
> The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication. Isn't that how the Sarah Palin thing happened?
- dkokelley 14y ago
  Yes. That's exactly the incident I was thinking of.