5 ms·
Why is nobody talking about password reset questions?
by nodata 12y ago
Why is nobody talking about password reset questions?
- spindritf 12y agoGoogle dropped them. We no longer support security questions as a way to access your account. https://support.google.com/mail/answer/183723?hl=en https://support.google.com/mail/answer/183723?hl=en
- raverbashing 12y agoYes Hopefully the idiots who call themselves security experts will stop making me answer "what's my mother's maiden name". If they really want to make it safe, one easy option would be to make the question arbitrary. Of course then average people will have no idea what to put it there. Of course, don't put "What is Love?" with the trivial answer...
- fabulist 12y ago> Hopefully the idiots who call themselves security experts will stop making me answer "what's my mother's maiden name". This is done by developers, not security experts. If security experts had their way, it would be equally bad but for the right reasons, ie client-side certificates or smart cards. Calling them idiots is also wrong. Its a bad solution to a hard problem, but it works and scales and users have been trained to expect it.
- r721 12y agoIt seems attackers used them somehow: "After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet. None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone." http://www.businesswire.com/news/home/20140902006384/en/Apple-Media-Advisory http://www.businesswire.com/news/home/20140902006384/en/Appl...
- ufmace 12y agoGood question, it's about time they were dropped entirely from anyone who claims to be protecting anything of value.
- ANTSANTS 12y agoI hate those so much. They lock me out of my accounts more often than they help. I always enter bogus answers because I think I'll never need to use the feature, then I run into a situation like: "Resetting your password via email? Ok, you also have to answer these security questions that you entered 'akjhdhksdfsdf' into when you made your account!" or "You've logged in from a new computer! Please try to remember what you thought your favorite band was 4 years ago. You have 3 tries remaining." Shit people, if you want me to write this stuff down, at least tell me when I'm creating my account that you basically expect me to have 4 passwords.
- mrweasel 12y agoI'm not sure if it's completely fair, but everytime I see "security questions" I can't help think: "Oh, it's an American site". Silly "security" questions about mothers, dogs and favorite teachers seems to be cultural to the US (and maybe Canada), why is that?
- scrollaway 12y agoThe whole "mother's maiden name" thing is pretty popular in US banks. I'd wager this is where it came from. Then again, you are talking about a country where the only thing people need to steal your identity is your ... social security number. Brilliant.
- mrweasel 12y agoStealing the social security number in Denmark is just as bad and possible easier than in the US. If you know a persons birthday and gender you have at least a 1 in 500 chance of simply guessing the last four digits.
- roel_v 12y agoThat's exactly not the point. The point is that it shouldn't matter that other people know your SSN. What effect does it have in Denmark when other people know your SSN?
- simonw 12y agoHaving moved to the US from the UK it's really noticeable how poor security culture is here in general. Plenty of things are secured by "the last 4 digits of your social security number", utility companies operate mainly on your address, very limited support for chip and pin (credit cards are still all signature based, and no one ever checks the signature).