5 ms·

I lost my apple account to an attacker. Apple wouldn't let me have the account back, even though I still controlled the email address for the account. Reason

by samspot 12y ago

I lost my apple account to an attacker. Apple wouldn't let me have the account back, even though I still controlled the email address for the account. Reason was because I could not answer a custom security question I made up over 10 years ago when I was still a student. My question: What is Brak's mom's thing? I hate security questions passionately. You have only a few options: 1) Put in some unforgettable public information so anyone can have your account. 2) Put in some secret, highly forgettable information that you won't remember. 3) Put in some standard response that will inevitably fail to meet the requirements for some questions. My first attempt at this was 'na' for not applicable, but many questions have a minimum # of characters

micampe 12y ago
Security questions are horrible, but I think the best solution is 2b: Put in some secret, highly forgettable information that you save in your password manager as a note together with your password.
- X-Istence 12y ago
  Which you sync to the cloud using iCloud, and you've lost access to your computer because the drive failed and now you can't answer the question because you can't access iCloud to get the information back out :P
  - micampe 12y ago
    Then sync it to two devices so you have two factor verification ;)
  - ensignavenger 12y ago
    You should never rely on the 'cloud' as your only backup. You should always have a local backup as well. At least, while we are on the subject of ideal best practices for individuals :)
- derefr 12y ago
  I feel like security questions are supposed to be part of the third pole of the "what you know, what you have, what you are" triangle. You lost the thing you have, or you forgot the thing you knew. The way to get it back is to prove that you are the things you are. Because of this, memories (mother's maiden name, high school you went to, etc.) are meaningless for security questions. These are effectively more passwords. The effective kind of security questions look something more like "how many moles do you have on your entire body" or "what is the position (in dental notation) of the tooth you cracked when you were 23". These are pieces of information you can derive by examining yourself, which you took the time to derive once (when you set up the question) and could, at any point, take the time to derive again--but which anyone else, to impersonate you, would basically have to have you tied up, naked, and incapacitated to figure out. Fingerprints, DNA samples, etc. also work for a 3FA, but only if taken interactively (that is, with a tester standing there watching you provide them.) Combining the two methods--having a battery of little assays, some self-derived, some assisted--works better, though, since any one of these dimensions might drift over time (you might get a new mole!) but together they should form a reasonable "profile" of you. --- A tangent: it'd be neat if there was a company that let you register a set of these tests to enable the release of something like a one-time private signing key held in escrow. You could just give these other third-parties that want 3FA questions the public-key fingerprint (never actually having had possession of the private key yet), and then if they ever need it, contact the challenge company to get your key unlocked and "re-notarize" your profiles with it.
  - LordKano 12y ago
    -"A tangent: it'd be neat if there was a company that let you register a set of these tests to enable the release of something like a one-time private signing key held in escrow. " I think I smell a start-up. Seriously. There will be some difficult questions to address, like how to finance an indefinite escrow and still charge a price low enough that you can draw customers and how to store the escrow in such a manner as to make it impractical for TLAs to bulk mine the whole thing but I think you have a good idea.
wahsd 12y ago
I see the bigger issue being that the security questions or answers are not usually properly encrypted or securely handled in the same way that we at least expect passwords to be handled. The other issue is that security questions should be customizable and people should, if the question and answer is properly hashed and encrypted, devise questions that are personal and remain relevant, e.g., where is your biggest mole?
- bpatrianakos 12y ago
  Yes, maybe they should be encrypted but that's still a problem because most of the time the answer can be correct in context but wrong technically. For example, "what's the name of your first pet?". If you originally answered "Spot" when you set it up then enter "spot" when you're asked later those two won't match after the hash is compared (if you use hashing) and it won't match if it's unencrypted either. That's an easy case to fix of course but there are other times when they ask for the name of your high school or something. I've been asked that several times and I'm not able to be consistent in my answer each time as sometimes my answer will be "Blah Blah High" or "Blah Blah Township High School" or any variation of that. Both answers are correct but only a person can see that. So as I see it, encryption or hashing is good for keeping the answers a secret but bad when it comes time to use those answers again.
electromagnetic 12y ago
I used to mix up the answers to the question. So "What is your mother's maiden name?" would be Nathan Fillion. "Who is your favourite actor?" would be my mother's insanely obscure maiden name (I've never heard it outside of the family). So unless someone knows I do this, it isn't even helpful to know personal information about me because I answer the questions seemingly nonsensically.
deleted 12y ago
[deleted]
msane 12y ago
Wasn't Brak that character on Space Ghost about 10 years ago? In case that helps...
- samspot 12y ago
  Yeah, and he had his own TV spinoff! I have the DVD's, but i don't want to watch the entire series on the chance that I still won't be able to figure out the answer.
  - msane 12y ago
    I just saw this reply. I remember thinking, doesn't she always have a vacuum cleaner? At least that's what I picture, it's been a while. You should mechanical turk watching the series :P
jeffmk 12y ago
I hate them as well. I use KeePassX to generate a random 20+ character alphanumeric "answer" to them, and input the question and answer in the entry comment field.
jiggy2011 12y ago
I've had the same problem (though not with apple), trying to remember what my favourite movie character was 12 years ago.

by samspot 12y ago

micampe 12y ago

Security questions are horrible, but I think the best solution is 2b: Put in some secret, highly forgettable information that you save in your password manager as a note together with your password.

X-Istence 12y ago
Which you sync to the cloud using iCloud, and you've lost access to your computer because the drive failed and now you can't answer the question because you can't access iCloud to get the information back out :P
- micampe 12y ago
  Then sync it to two devices so you have two factor verification ;)
- ensignavenger 12y ago
  You should never rely on the 'cloud' as your only backup. You should always have a local backup as well. At least, while we are on the subject of ideal best practices for individuals :)
derefr 12y ago
I feel like security questions are supposed to be part of the third pole of the "what you know, what you have, what you are" triangle. You lost the thing you have, or you forgot the thing you knew. The way to get it back is to prove that you are the things you are. Because of this, memories (mother's maiden name, high school you went to, etc.) are meaningless for security questions. These are effectively more passwords. The effective kind of security questions look something more like "how many moles do you have on your entire body" or "what is the position (in dental notation) of the tooth you cracked when you were 23". These are pieces of information you can derive by examining yourself, which you took the time to derive once (when you set up the question) and could, at any point, take the time to derive again--but which anyone else, to impersonate you, would basically have to have you tied up, naked, and incapacitated to figure out. Fingerprints, DNA samples, etc. also work for a 3FA, but only if taken interactively (that is, with a tester standing there watching you provide them.) Combining the two methods--having a battery of little assays, some self-derived, some assisted--works better, though, since any one of these dimensions might drift over time (you might get a new mole!) but together they should form a reasonable "profile" of you. --- A tangent: it'd be neat if there was a company that let you register a set of these tests to enable the release of something like a one-time private signing key held in escrow. You could just give these other third-parties that want 3FA questions the public-key fingerprint (never actually having had possession of the private key yet), and then if they ever need it, contact the challenge company to get your key unlocked and "re-notarize" your profiles with it.
- LordKano 12y ago
  -"A tangent: it'd be neat if there was a company that let you register a set of these tests to enable the release of something like a one-time private signing key held in escrow. " I think I smell a start-up. Seriously. There will be some difficult questions to address, like how to finance an indefinite escrow and still charge a price low enough that you can draw customers and how to store the escrow in such a manner as to make it impractical for TLAs to bulk mine the whole thing but I think you have a good idea.

wahsd 12y ago

I see the bigger issue being that the security questions or answers are not usually properly encrypted or securely handled in the same way that we at least expect passwords to be handled. The other issue is that security questions should be customizable and people should, if the question and answer is properly hashed and encrypted, devise questions that are personal and remain relevant, e.g., where is your biggest mole?

bpatrianakos 12y ago
Yes, maybe they should be encrypted but that's still a problem because most of the time the answer can be correct in context but wrong technically. For example, "what's the name of your first pet?". If you originally answered "Spot" when you set it up then enter "spot" when you're asked later those two won't match after the hash is compared (if you use hashing) and it won't match if it's unencrypted either. That's an easy case to fix of course but there are other times when they ask for the name of your high school or something. I've been asked that several times and I'm not able to be consistent in my answer each time as sometimes my answer will be "Blah Blah High" or "Blah Blah Township High School" or any variation of that. Both answers are correct but only a person can see that. So as I see it, encryption or hashing is good for keeping the answers a secret but bad when it comes time to use those answers again.

electromagnetic 12y ago

I used to mix up the answers to the question. So "What is your mother's maiden name?" would be Nathan Fillion. "Who is your favourite actor?" would be my mother's insanely obscure maiden name (I've never heard it outside of the family). So unless someone knows I do this, it isn't even helpful to know personal information about me because I answer the questions seemingly nonsensically.

deleted 12y ago

[deleted]

msane 12y ago

Wasn't Brak that character on Space Ghost about 10 years ago? In case that helps...

samspot 12y ago
Yeah, and he had his own TV spinoff! I have the DVD's, but i don't want to watch the entire series on the chance that I still won't be able to figure out the answer.
- msane 12y ago
  I just saw this reply. I remember thinking, doesn't she always have a vacuum cleaner? At least that's what I picture, it's been a while. You should mechanical turk watching the series :P

jeffmk 12y ago

I hate them as well. I use KeePassX to generate a random 20+ character alphanumeric "answer" to them, and input the question and answer in the entry comment field.

jiggy2011 12y ago

I've had the same problem (though not with apple), trying to remember what my favourite movie character was 12 years ago.