6 ms·
another bad habit are those "security questions". For me, the only proper way to deal with this is to have your mother maiden or pet name be cy4nEp7UtNsz and sa
by eik3_de 13y ago
another bad habit are those "security questions".
For me, the only proper way to deal with this is to have your mother maiden or pet name be cy4nEp7UtNsz and save that (along with the question title) in your (properly backed up!) password safe.
- frou_dh 13y agoAgreed. If I get to pick the security question itself, it'll be something like "What's the magic code?" to emphasise that the gibberish answer was set intentionally.
- privong 13y ago> and save that (along with the question title) in your (properly backed up!) password safe. To be fair, this could render the security question useless. If you lose the password (by losing the password safe), you've also lost the answer to the security question. So a properly backed up password safe renders a security question pointless (or the answers to the security question should be stored in a separate, equally secure, location).
- eik3_de 13y agoYou're right, it's not the intended use of the security question - and that's exactly what I want. I feel like entering my pet's name doesn't add to my account security but rather lowers it. My password safe is stored at many different location so that it's extremely unlikely to loose them all at once. And to secure against amnesia or being-hit-by-a-truck, you should give the passphrase to a person you trust 100%.
- PinguTS 13y agoThe security questions in its current implementation are useless anyhow. Because all those pieces of information are exploitable by your social life these days. "What's the name of your first math teacher" — Take a look into the years schoolbook, which are online. These security questions are made for us old farts, for days when there was no Internet like today and there were none of this information available online.
- ryandrake 13y ago"Security questions" are already worse than useless, because they provide an easier attack vector (if they are answered honestly). Things like your pet's name and the street you lived on as a child are easily obtainable online. Companies should allow security-conscious customers the ability to opt out of this attack vector. Alternatively, just use another 20 character randomly generated string for each of the answers.
- aptwebapps 13y agoUseless for the intended purpose, but when you login to your bank's website from a different IP (or something similar) and it triggers the security question - then you have it without making it something that someone else can figure out.
- randallsquared 13y agoSecurity questions are already useless. What's my first pet's name? Depending on the day, I might have any of three or four answers; I'm unlikely to remember which pet was first, 30-35 years ago, even if I think I can, since if you ask me in a month, I might be just as confident the other way! Given the uncertainty, I might well decide that the best answer is a later pet I remember better, but then which one is that? I remember the names of exactly two teachers from high school, today, but only because I was discussing something about them with someone else who remembered over Christmas. My mother's maiden name is spelled differently on her birth certificate and death certificate, so I can't tell which one future me might use after forgetting a password. Recently, I've noticed a trend of having 6 or 8 fixed security questions to choose 2 or 3 from, none of which actually apply to me in a reliable way. There's really no other solution but to treat them as an additional password field.
- taeric 13y agoStrictly speaking, they do have one benefit. If someone steals your password, there is really no way to know. If they reset your account with a security question, you'll know as soon as you access. Still pretty terrible, though.
- sbierwagen 13y agoI've run into security questions where there were character limits on the answer. "Between 3 and 20 characters, no numbers." The worst of all possible worlds!
- steven2012 13y agoSecurity questions is one of the stupidest ideas in the so-called "security" industry. This causes so much information leakage and confusion and doesn't really solve anything. They really need to be removed from every company's security protocol.
- coldpie 13y agoI always wondered if phone CSRs use those to authenticate a caller. I wasn't looking forward to reading out a 40-digit string of nonsense over the phone. Good to know all they require is that you can guess a 2-digit number instead...
- claudius 13y agoAlice (telco) at one point required the password I used on the website to identify me on the phone. Quite sensible as authentication/identification (though it requires the password to be stored in plain text somewhere, something I don’t really care about) in theory and reading out aPua6EG8H0nB6UIxOwsQQeVYUF71NRQ9AkBqg4rujU8vAcLMnG is not all that hard.
- deleted 13y ago[deleted]
- brigade 13y agoI like how Yahoo suddenly decided to make their "security questions" a secondary password. I have no idea what I answered over a decade ago, but I can no longer log into my account despite them acknowledging my password to be correct. Where's the "reset security question" option...
- JoshGlazebrook 13y agoOr even Gmail. Since when do they require you to guess when you opened your account and all of that information? As if I have any idea what month/year I opened my gmail account. I feel like if I ever got locked out of it or were in this situation I wouldn't know the information to get back into it.
- DanBC 13y agoGoogle are strict about letting people have access. You need to make sure that your access to gmail is safe. "Make back ups" is easy to say, but keeping the passwords and access credentials safe is tricky.
- Nicholas_C 13y agoI actually ran into this the other day. The account I had used from 8th grade to about 11th is now probably gone forever.
- dublinben 13y agoOnly until they decide to recycle the usernames.
- plaguuuuuu 13y agoJudging by the recent articles, you should at least be able to call them and get access to your (or probably someone else's) account.
- protomyth 13y agoI tell folks to pick a phrase they can remember for long periods of time and use that regardless of the question. "my first pet" = "the refrigerator is walking" or some such thing.
- lucb1e 13y agoI set security questions to something random and never store it. It's only a risk to store it. The only time I needed my security question was when changing email address on PayPal. I gave them a call and was able to change it by reading the security code (a randomly generated PIN). Any company giving access to your account by security questions is not to be trusted. I never keep more than a few euros in my PayPal account for multiple reasons, and this is one of them. Shameless plug to a post I wrote on security questions: https://lucb1e.com/?p=post&id=65 https://lucb1e.com/?p=post&id=65
- jordsmi 13y agoSecurity questions don't even help. Some of the support reps from various companies can see your answer and with enough prodding they will just tell you it over the phone.
- morgante 13y agoI agree that security questions are 100% a joke, in that they're completely useless and potentially represent an attack vector. Unfortunately some services have the annoying habit of randomly providing multiple choice for these (ex. TradeKing). So my qgwpagprgqrgwasr2q really sticks out as an odd answer for my first car, making it even more guessable than the real answer. There really needs to be a way to completely opt out of these systems for competent consumers. I'd never need a password reset, so they shouldn't allow it.