4 ms·

Nice to see someone finally formalizing what to me seems pretty obvious. Adding account recovery inherently lowers security. 1. Additional vector of attack wit

by joshuak 11y ago

Nice to see someone finally formalizing what to me seems pretty obvious. Adding account recovery inherently lowers security. 1. Additional vector of attack with lower than password threshold of security. 2. Questions may have common answers. 3. Few possible answers. 4. Publicly available answers. 5. Social engineering can phish for answers easily. 6. Answers may be easily known or guessed by social proximity (family, friends, coworkers). Transient information questions like "favorite food", unknown strictness rules like capitalization or character exclusions cause users to pick consistent answers that do not necessarily relate to the question. This along with inconsistent passwords rules across all sites, and none of them showing the rules on the login page to remind you, piss me off to no end. Please can we start using public key cryptography, and just have our own private keys? Please!!!! If you ever create password based web apps or work in security please at least watch this MIT lecture. https://youtu.be/M2gc6b1hmk8?t=5m15s https://youtu.be/M2gc6b1hmk8?t=5m15s (cued to start of lecture)

giltleaf 11y ago
Or at least less ponderous pw restrictions. Thanks for sharing that video.
Yizahi 11y ago
Also you will never ever remember what you wrote in that particular question (unless you will threat it like second password). And considering that anything less than 12 random chars now can be broken in hours... I really don't know what companies think when they expect us to write "white", "1977" as a complete password substitute. And lots of companies like to screw you in many different and inventive ways using this crap. For example Apple - they asked me for two security questions during registration (and I wrote it down of course), then at some point they added a third one with some random answer that I didn't fill. So now I have to open page with question a few times to get both of the questions that I did fill in and not one known and one not. (this happened to my oldest account, for two new appleIDs apple asked for all 3 questions correctly).

by joshuak 11y ago

giltleaf 11y ago

Or at least less ponderous pw restrictions. Thanks for sharing that video.

Yizahi 11y ago

Also you will never ever remember what you wrote in that particular question (unless you will threat it like second password). And considering that anything less than 12 random chars now can be broken in hours... I really don't know what companies think when they expect us to write "white", "1977" as a complete password substitute. And lots of companies like to screw you in many different and inventive ways using this crap. For example Apple - they asked me for two security questions during registration (and I wrote it down of course), then at some point they added a third one with some random answer that I didn't fill. So now I have to open page with question a few times to get both of the questions that I did fill in and not one known and one not. (this happened to my oldest account, for two new appleIDs apple asked for all 3 questions correctly).