6 ms·

> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-ques

> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext? I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).

duaneb 14y ago
They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.
- danso 14y ago
  Well, that would be thhe reason, I think... Example: For: "Who was your favorite high school teacher." - Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood
  - dhimes 14y ago
    Of course, your answer should NEVER match the question. But that's beside the point. "Whose was your favorite high school teacher?" -Pecan pie.
    - untog 14y ago
      The point still stands, though. There is way, way too much potential variation to hash that stuff.
      - Steko 14y ago
        I think the bigger point is that a ton of signups use this question. Whether you say 'Mr. Smith' or 'Pecan Pie' isn't going to save you if you use it for all of them.
        dhimes 14y ago
        Actually, you often get to pick your question. If they don't hash the answer, however, you're screwed. It seems doable to me: drop on non alphanumeric (or something), split on whitespace, trim, lowercase, put back together. It beats the hell out of putting in the "right," googleable, answer. Sarah Palin can attest to that.
        Steko 14y ago
        Getting to pick your own question in my experience is rare. We've already gone over the possible reasoning for not hashing the answer.
        duaneb 14y ago
        The only company I use that allows me to pick my security question is google. Apple doesn't, my bank definitely doesnt.
        warp 14y ago
        At appleid.apple.com I can pick from a list of 15 security questions or use a custom one.
        duaneb 14y ago
        Strange - I have only preset questions.
    - smsm42 14y ago
      The only problem is that in 5 years you'd have no idea what you answered there. And that's exactly when you'd need it.
      - wlievens 14y ago
        Yeah, unless you do it consistently everywhere, which again defeats the purpose. Maybe you could do something like consistently answer the previous question from the dropdown?
        roc 14y ago
        Or use a tool like 1password to generate and store the 'answers'.
        smsm42 14y ago
        You need those answers exactly when you don't have the password, which means your 1password failed for some reason (otherwise you'd have the password from it). For me it usually happens with sites that generate their own passwords which I for some reason failed to enter into 1password some time ago (probably because I didn't use the site for a long time).
- comicjk 14y ago
  You could still do fuzzy matching with a one-way hash, you would just have to generate the fuzz beforehand. Create ten or twenty strings which you will also accept and hash and store them all.
gizzlon 14y ago
> a two-way hash (that their support app reverses) Isn't that just encryption?
- Jgrubb 14y ago
  I'm not a security expert, but yes. Hashing is, by definition, a one way process. If it is meant to be encrypted and decrypted it's, well, encryption...

duaneb 14y ago

They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.

danso 14y ago
Well, that would be thhe reason, I think... Example: For: "Who was your favorite high school teacher." - Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood
- dhimes 14y ago
  Of course, your answer should NEVER match the question. But that's beside the point. "Whose was your favorite high school teacher?" -Pecan pie.
  - untog 14y ago
    The point still stands, though. There is way, way too much potential variation to hash that stuff.
    - Steko 14y ago
      I think the bigger point is that a ton of signups use this question. Whether you say 'Mr. Smith' or 'Pecan Pie' isn't going to save you if you use it for all of them.
      - dhimes 14y ago
        Actually, you often get to pick your question. If they don't hash the answer, however, you're screwed. It seems doable to me: drop on non alphanumeric (or something), split on whitespace, trim, lowercase, put back together. It beats the hell out of putting in the "right," googleable, answer. Sarah Palin can attest to that.
        Steko 14y ago
        Getting to pick your own question in my experience is rare. We've already gone over the possible reasoning for not hashing the answer.
        duaneb 14y ago
        The only company I use that allows me to pick my security question is google. Apple doesn't, my bank definitely doesnt.
        warp 14y ago
        At appleid.apple.com I can pick from a list of 15 security questions or use a custom one.
        duaneb 14y ago
        Strange - I have only preset questions.
  - smsm42 14y ago
    The only problem is that in 5 years you'd have no idea what you answered there. And that's exactly when you'd need it.
    - wlievens 14y ago
      Yeah, unless you do it consistently everywhere, which again defeats the purpose. Maybe you could do something like consistently answer the previous question from the dropdown?
      - roc 14y ago
        Or use a tool like 1password to generate and store the 'answers'.
        smsm42 14y ago
        You need those answers exactly when you don't have the password, which means your 1password failed for some reason (otherwise you'd have the password from it). For me it usually happens with sites that generate their own passwords which I for some reason failed to enter into 1password some time ago (probably because I didn't use the site for a long time).
comicjk 14y ago
You could still do fuzzy matching with a one-way hash, you would just have to generate the fuzz beforehand. Create ten or twenty strings which you will also accept and hash and store them all.

gizzlon 14y ago

> a two-way hash (that their support app reverses) Isn't that just encryption?

Jgrubb 14y ago
I'm not a security expert, but yes. Hashing is, by definition, a one way process. If it is meant to be encrypted and decrypted it's, well, encryption...