3 ms·

I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in eleme

by HiPhish 11mo ago

I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in elementary school?" might have different answers depending on when you ask me. Plus, unless my best friend's name was Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz (we used to call him Joe) it's pretty easy to guess with a dictionary attack. The only way to answer these questions securely is to make up an answer that's impossible to guess, which results in a second password. > You password must contain these particular characters I understand that this rule is to prevent people from using passwords like "kittycat", but "k!ttyc4T" is still less secure than "horse battery staple correct".

card_zero 11mo ago
I remember that a not-so-recent investigation recommended five words. (Also you got the order wrong, "correct" was at the front, but you'd probably get it right second try, so the concept is still good.)
Waterluvian 11mo ago
> Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz How in the #%*^ did you figure out my secret question? I absolutely hate security theatre. And these kinds of things are just that. In fact, I’m sure that difficult to remember passwords make us less secure as we forget or write them down.
thayne 11mo ago
> "kittycat", but "k!ttyc4T" is still less secure than "horse battery staple correct". Well... something like that. Please don't use exactly "horse battery staple correct".
- card_zero 11mo ago
  Oh, that was probably the point, that it's very weak but still better than k!ttyc4T. We both got downvoted for not picking up that implication. This thread requires too much mind-reading for me.
- HiPhish 11mo ago
  Yeah, I was referencing XKCD 936. Of course everyone should use a set of dice to roll their own truly random diceword passphrase and use five or six worst. My point was that adding numbers and other special characters does not actually make the password more secure than four, five, six or however many random plain English words that just use lower-case characters, so this rule should never be enforced.
yegle 11mo ago
There seems to be an easy solution: use a password manager and save the answer to the question as an additional password. (This is actually a FR to any password manager's product team: it's time to treat things like 2FA recovery code and secret question answers as first class citizen in your product).
- jeltz 11mo ago
  KeepassXC already supports 2FA.
  - vrighter 11mo ago
    this is not 2fa though
- eulgro 11mo ago
  Exactly. My mother's maiden name is "xGj5kLm9abM16q". Which is why she no longer uses it I guess?
  - deleted 11mo ago
    [deleted]
- HiPhish 11mo ago
  That's what I do as well, but that defeats the purpose of the secret question being something only I know and will not forget. And that's because I am aware of the flaw of this system; someone naive might actually fill out that question with the honest answer and leave himself wide open to being exploited. Password manager are not a solution, they are a band-aid fix to a problem we should not be having in the first place.

by HiPhish 11mo ago

card_zero 11mo ago

I remember that a not-so-recent investigation recommended five words. (Also you got the order wrong, "correct" was at the front, but you'd probably get it right second try, so the concept is still good.)

Waterluvian 11mo ago

> Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz How in the #%*^ did you figure out my secret question? I absolutely hate security theatre. And these kinds of things are just that. In fact, I’m sure that difficult to remember passwords make us less secure as we forget or write them down.

thayne 11mo ago

> "kittycat", but "k!ttyc4T" is still less secure than "horse battery staple correct". Well... something like that. Please don't use exactly "horse battery staple correct".

card_zero 11mo ago
Oh, that was probably the point, that it's very weak but still better than k!ttyc4T. We both got downvoted for not picking up that implication. This thread requires too much mind-reading for me.
HiPhish 11mo ago
Yeah, I was referencing XKCD 936. Of course everyone should use a set of dice to roll their own truly random diceword passphrase and use five or six worst. My point was that adding numbers and other special characters does not actually make the password more secure than four, five, six or however many random plain English words that just use lower-case characters, so this rule should never be enforced.

yegle 11mo ago

There seems to be an easy solution: use a password manager and save the answer to the question as an additional password. (This is actually a FR to any password manager's product team: it's time to treat things like 2FA recovery code and secret question answers as first class citizen in your product).

jeltz 11mo ago
KeepassXC already supports 2FA.
- vrighter 11mo ago
  this is not 2fa though
eulgro 11mo ago
Exactly. My mother's maiden name is "xGj5kLm9abM16q". Which is why she no longer uses it I guess?
- deleted 11mo ago
  [deleted]
HiPhish 11mo ago
That's what I do as well, but that defeats the purpose of the secret question being something only I know and will not forget. And that's because I am aware of the flaw of this system; someone naive might actually fill out that question with the honest answer and leave himself wide open to being exploited. Password manager are not a solution, they are a band-aid fix to a problem we should not be having in the first place.