5 ms·
Reminds me of working at a company blocking access to eBay because their URL had .dll in there. Also, we were thought to inspect the URL before clicking on it.
by OptionOfT 1y ago
Reminds me of working at a company blocking access to eBay because their URL had .dll in there.
Also, we were thought to inspect the URL before clicking on it.
Except that the spam system they use completely mangles the URL...
- Terr_ 1y ago> Except that the spam system they use completely mangles the URL... I hate this trend. Like an overused pool of the same "Secret Questions" every company asks, it needs to be on some "X considered harmful" list.
- eru 1y agoI usually just ask my password generator to generate another random password for the secret question's answer.
- Terr_ 1y agoIt's possible an attacker might say: "My first pet's name is random gibberish", and the person on the other end goes: "Yep, that's what it says." I'm not sure how many companies that would happen at, but it seems... just dumb enough to be plausible.
- Marsymars 1y ago1Password’s default for secret questions is a sequence of English words, rather than random gibberish.
- rjsw 1y agoSee https://xkcd.com/936/ https://xkcd.com/936/
- eru 1y agoWhy would you want to memorise a password? That's what password managers or even paper is for. (Writing your passwords down on paper is actually less crazy than it sounds like: It's impossible to hack paper from the internet. And, if someone has physical access to your stuff, they could install a keylogger anyway.)
- avhon1 1y agoPasswords in this style (passphrases) are also much easier to transcribe to devices that don't have or support password managers, or when sharing a password verbally or in writing.
- juped 1y agogot to have a password manager password, and a login password
- eru 1y agoWrite that down on a piece of paper.
- OptionOfT 1y agoFor secret answers like this I have Bitwarden generate a set of words that I put in. The words are actual English words, so the 'random gibberish' moniker wouldn't be correct. But at least the answer doesn't match the question. I've also learned to store the question, as some websites make you select the question before providing the answer. And my answers don't allude to what the original question was.
- eru 1y ago> I've also learned to store the question, as some websites make you select the question before providing the answer. And my answers don't allude to what the original question was. I usually pick the first or default question. But yeah, that order might change.
- 1y ago
- incone123 1y agoThe CSR shouldn't see the whole string but not all systems follow that approach.
- edm0nd 1y agoyup same here my high school mascot? fish-car-base-picture((#$#$&#*4303483
- reaperducer 1y agoI usually just ask my password generator to generate another random password for the secret question's answer. Not great when you're on the phone with United Airlines and the person who's trying to help you get un-stranded asks what your favorite ice cream flavor is. United has the absolute stupidest secret questions.