4 ms·

From the comments section of the linked blog post comes this quote (apparently) from Ben, the CEO at Site5: To be rather blunt you should have better security

by miles 14y ago

From the comments section of the linked blog post comes this quote (apparently) from Ben, the CEO at Site5: To be rather blunt you should have better security questions. You should always put in a custom answer, for example I might use the question mother's maiden name and then the answer is "L@J-289098=a9jaosdjf" which I keep in an encrypted text doc or ecrypted note in 1Password. Not a bad point.

doublec 14y ago
Maybe Site5 should ask better security questions then. If they want users to enter what is effectively a password for "Mother's maiden name" they should just ask for a security password.
- obstacle1 14y ago
  I agree that the true-to-life reminder questions are probably an outdated model. However there's nothing intrinsically wrong with the maiden name question. There is no server-side code checking in with your mother or running her middle name against a federal database, you can enter whatever you want in the box. Surely people who are savvy enough to be trading in Bitcoin realize this.
  - michaelt 14y ago
    However there's nothing intrinsically wrong with the maiden name question. Asking users to enter their mother's maiden name, when you actually think they certainly shouldn't do that, then blaming your customers for having used their maiden name, seems like an odd way of doing it. If mother's maiden name isn't a good enough security question, stop asking it! And we all know it isn't a good enough security question.
- miles 14y ago
  Maybe Site5 should ask better security questions then. Looks like they have allowed users to create their own for quite a while: We have allowed customers to write their own security questions for over two and a half years now. http://www.site5.com/blog/s5/security-and-social-engineering/20130307/ http://www.site5.com/blog/s5/security-and-social-engineering...
- raverbashing 14y ago
  Yes It's a pain, but I don't trust this "Mother's Maiden name" invention. Problem is remembering this (and some offline systems have it as well, oh well) So if you think I'm going to put the actual name there you're wrong. Maybe not +@sfghh#54$=24 but something different.
lhnn 14y ago
If that is the CEO of Site5, I would never use that company again, and I publicly laugh at their audacity in denying their team's incompetence. Yes. Not using true information is a good practice for security questions. If the CEO of a technical company thinks so, as well, then don't fscking ask me for my mum's maiden name! 1) Ask for a backup password and specify it should be kept offline. 2) Tell users to lie on the maiden name question. Do NOT point the finger after a breach at your company to one of your customers. Terrible practice.
bdc 14y ago
To paraphrase: the question 'What is your mother's maiden name?' is intrinsically insecure as a security measure; instead of answering it directly, make up some unguessable string that has nothing to do with the question. Sound advice, but... but... but..... This is his own website using this as a security question!
- cookiecaper 14y ago
  It's about the target audience. Most normal people aren't going to be using their registered domain name for extremely high-value and highly targeted stuff, and they'll be upset if you say "Oh, you forgot your random string? Well, I guess you're screwed bub, sorry". But if you're doing something involving btc, you should be conscious enough to know "maybe I shouldn't put the security of my account behind easily locatable public info like the name of myself or family members".
tlrobinson 14y ago
1) They shouldn't be asking this type of question in the first place. They're promoting insecure practices, and can't seriously expect all their customers to know they should lie in their answers. 2) Knowing the answers to those questions shouldn't allow an attacker direct access to the account. It should initiate a password reset via email.
- randomfool 14y ago
  re: 2- the attackers apparently had an email address very similar to the victim's email. Most likely just convinced the tech support that the victim's email addr had a typo.
  - tlrobinson 14y ago
    Either way it's Site5's fault. They need to be aware of social engineering attacks.
ShaneWilton 14y ago
At that point, what is the point of the secret question in the first place? If I lose my password, I probably also lost my security answer, and even if they're stored in separate places, then isn't it just another vector of attack which does nothing for my security anyway?

by miles 14y ago

doublec 14y ago

Maybe Site5 should ask better security questions then. If they want users to enter what is effectively a password for "Mother's maiden name" they should just ask for a security password.

obstacle1 14y ago
I agree that the true-to-life reminder questions are probably an outdated model. However there's nothing intrinsically wrong with the maiden name question. There is no server-side code checking in with your mother or running her middle name against a federal database, you can enter whatever you want in the box. Surely people who are savvy enough to be trading in Bitcoin realize this.
- michaelt 14y ago
  However there's nothing intrinsically wrong with the maiden name question. Asking users to enter their mother's maiden name, when you actually think they certainly shouldn't do that, then blaming your customers for having used their maiden name, seems like an odd way of doing it. If mother's maiden name isn't a good enough security question, stop asking it! And we all know it isn't a good enough security question.
miles 14y ago
Maybe Site5 should ask better security questions then. Looks like they have allowed users to create their own for quite a while: We have allowed customers to write their own security questions for over two and a half years now. http://www.site5.com/blog/s5/security-and-social-engineering/20130307/ http://www.site5.com/blog/s5/security-and-social-engineering...
raverbashing 14y ago
Yes It's a pain, but I don't trust this "Mother's Maiden name" invention. Problem is remembering this (and some offline systems have it as well, oh well) So if you think I'm going to put the actual name there you're wrong. Maybe not +@sfghh#54$=24 but something different.

lhnn 14y ago

If that is the CEO of Site5, I would never use that company again, and I publicly laugh at their audacity in denying their team's incompetence. Yes. Not using true information is a good practice for security questions. If the CEO of a technical company thinks so, as well, then don't fscking ask me for my mum's maiden name! 1) Ask for a backup password and specify it should be kept offline. 2) Tell users to lie on the maiden name question. Do NOT point the finger after a breach at your company to one of your customers. Terrible practice.

bdc 14y ago

To paraphrase: the question 'What is your mother's maiden name?' is intrinsically insecure as a security measure; instead of answering it directly, make up some unguessable string that has nothing to do with the question. Sound advice, but... but... but..... This is his own website using this as a security question!

cookiecaper 14y ago
It's about the target audience. Most normal people aren't going to be using their registered domain name for extremely high-value and highly targeted stuff, and they'll be upset if you say "Oh, you forgot your random string? Well, I guess you're screwed bub, sorry". But if you're doing something involving btc, you should be conscious enough to know "maybe I shouldn't put the security of my account behind easily locatable public info like the name of myself or family members".

tlrobinson 14y ago

1) They shouldn't be asking this type of question in the first place. They're promoting insecure practices, and can't seriously expect all their customers to know they should lie in their answers. 2) Knowing the answers to those questions shouldn't allow an attacker direct access to the account. It should initiate a password reset via email.

randomfool 14y ago
re: 2- the attackers apparently had an email address very similar to the victim's email. Most likely just convinced the tech support that the victim's email addr had a typo.
- tlrobinson 14y ago
  Either way it's Site5's fault. They need to be aware of social engineering attacks.

ShaneWilton 14y ago

At that point, what is the point of the secret question in the first place? If I lose my password, I probably also lost my security answer, and even if they're stored in separate places, then isn't it just another vector of attack which does nothing for my security anyway?