3 ms·

Damn, that must be frustrating as hell when a third party fucks you like that. And why is it always the DNS providers. Shouldn't that entire industry know they

by vinhboy 14y ago

Damn, that must be frustrating as hell when a third party fucks you like that. And why is it always the DNS providers. Shouldn't that entire industry know they are target #1 by now? On a tangential note, I hate security questions. I do not understand the need for them, or how they keep anything secure, when the questions they asks are always public knowledge.

DannyBee 14y ago
Until they start getting held liable, why should they care?
niggler 14y ago
"I hate security questions. I do not understand the need for them, or how they keep anything secure, when the questions they asks are always public knowledge." Like with most things, security questions create a facade of security. Just like the "at least one lower case letter, one uppercase letter, one number, and one non-alphanumeric character" requirement of some sites: more often than not, the resulting password is "easier" to guess (many people put the numbers at the end, etc)
- r4vik 14y ago
  there's no reason for you to give them your actual mother's maiden name though, just tell them M)z&1<$Ccy(i]Kg&&dp` or something
  - mctx 14y ago
    That's a great idea for online services, assuming that they don't have strict validatation ("your mother's maiden name can not contain symbols"). I'm not sure it would work as well with companies who call you though.
  - jzwinck 14y ago
    That's right: someone who knows their credentials will be the focus of deliberate attacks should never use truthful personal details in response to these "security questions." Perhaps this is a "best practice" for anyone involved in such sensitive situations, even while the true best practice would be for sites to not allow password resets using such unreliable authenticators.
  - ceejayoz 14y ago
    This, incidentally, makes for fun conversations with phone support.
signed0 14y ago
While I agree that they are useless, I don't mind the security questions that are used to reset one's password, provided that proof of email ownership is required. These are just a minor nuisance. The dangerous ones such as this allow someone to use the security questions in place of your password. These are less secure than if you were to use your place of birth and address as your password. Their thought process probably goes something like "we can't have users giving us their password over the phone, anyone could overhear that and they would think it is insecure. Lets have them give us something less confidential instead". Services like this that require verbal authentication via the telephone should generate a passphrase and email it to their uses upon signup.
- tjoff 14y ago
  So, when signing up, how do you know what the security question is going to be used for? And how do you know that won't change? Any service that is sensible enough to give you that information will hardly make use of "security-questions" in the first place...

by vinhboy 14y ago

DannyBee 14y ago

Until they start getting held liable, why should they care?

niggler 14y ago

"I hate security questions. I do not understand the need for them, or how they keep anything secure, when the questions they asks are always public knowledge." Like with most things, security questions create a facade of security. Just like the "at least one lower case letter, one uppercase letter, one number, and one non-alphanumeric character" requirement of some sites: more often than not, the resulting password is "easier" to guess (many people put the numbers at the end, etc)

r4vik 14y ago
there's no reason for you to give them your actual mother's maiden name though, just tell them M)z&1<$Ccy(i]Kg&&dp` or something
- mctx 14y ago
  That's a great idea for online services, assuming that they don't have strict validatation ("your mother's maiden name can not contain symbols"). I'm not sure it would work as well with companies who call you though.
- jzwinck 14y ago
  That's right: someone who knows their credentials will be the focus of deliberate attacks should never use truthful personal details in response to these "security questions." Perhaps this is a "best practice" for anyone involved in such sensitive situations, even while the true best practice would be for sites to not allow password resets using such unreliable authenticators.
- ceejayoz 14y ago
  This, incidentally, makes for fun conversations with phone support.

signed0 14y ago

While I agree that they are useless, I don't mind the security questions that are used to reset one's password, provided that proof of email ownership is required. These are just a minor nuisance. The dangerous ones such as this allow someone to use the security questions in place of your password. These are less secure than if you were to use your place of birth and address as your password. Their thought process probably goes something like "we can't have users giving us their password over the phone, anyone could overhear that and they would think it is insecure. Lets have them give us something less confidential instead". Services like this that require verbal authentication via the telephone should generate a passphrase and email it to their uses upon signup.

tjoff 14y ago
So, when signing up, how do you know what the security question is going to be used for? And how do you know that won't change? Any service that is sensible enough to give you that information will hardly make use of "security-questions" in the first place...