10 ms·
> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager The problem with this is that t
by JupiterMoon 9y ago
> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager
The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..
- musage 9y agoBut the attacker kind of has to know the answer is gibberish from the bat, otherwise they'd either guess or pretend to not remember a real answer, which is noticeably different from saying something like "oh, that's 30 random characters but I don't have the note with me right now".
- tonyedgecombe 9y agoBut we already know @sersi just mashes the keyboard for those questions :)
- sersi 9y agoSure, but I doubt it would be easy to find my identity from my hn account name.
- cortesoft 9y agoHere is how it would go... attacker gives a real answer, support says no that isn't it. Attacker goes, "oh, sometimes I give fake answers for the question... is it a really long string of characters?" Or they could go through a few things like that, always giving the excuse that they give false answers until they stumble on the right one.
- Sir_Cmpwn 9y agoYou don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.
- wyager 9y agoIt's not about what you say, it's about what an attacker can get away with saying. And they can almost certainly get away with "I just mash the keyboard."
- Sir_Cmpwn 9y agoAh, I see what you mean. Perhaps instead of grabbing a handful of characters from /dev/urandom, you generate a passphrase (a few random dictionary words)?
- np_tedious 9y agoSounds like a "correct battery horse staple" would fit the bill
- chiph 9y agoOr use a memorable phrase from literature. > This was not the last encounter between Bobby Shaftoe and Goto Dengo
- mighty_atomic_c 9y agoNecronomicon quote? Nice. This has me thinking about what I can do to make my security answers to security questions untethered from PII. A book quote is a really good idea.
- chiph 9y agoClose! Cryptonomicon. I'm guessing that having every book loaded into a password cracking database, subdivided and indexed by each leading phrase word, is still computationally infeasible for non-government actors.
- luiscarloscb 9y ago
- LoSboccacc 9y agothat places the liability on the phone rep, while guessing an easy answer places it on you, so still a better choice
- l0b0 9y agoJust generate a pronounceable word, for example using KeePass*.
- JumpCrisscross 9y ago> The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account I used to do this and then lost my password file. Fast forward to a call with AT&T. I told them I forgot my secret answers. They offered that it was "a super weird answer," which let me use the "mashed keyboard" line and got in. TL; DR I think this system is less safe than just making up cars, cities, et cetera.
- ohazi 9y agocorrect horse battery staple?
- alphast0rm 9y agoThis is a reference to the XKCD comic, Password Strength [1]. [1] https://xkcd.com/936/ https://xkcd.com/936/
- deleted 9y ago[deleted]
- ncallaway 9y agoYea, I always use a handful of random words. That way, it's something pronouncable over the phone. Still, I expect "oh, it's a random word not related to the question" would clear phone screen human layer of verification a good percentage of the time.
- evincarofautumn 9y agoOne trick is to use pronounceable passwords as answers to security questions, like a sequence of words (“Mother’s maiden name?” “correct horse battery staple”) or arbitrary syllables that make it sound as if you’re having a mini-stroke (“Where were you born?” “prisencolinensinainciusol, oll raigth”).
- tonyztan 9y agoOne solution would be to randomly generate security answers with human readable words. Diceware does this. You can use a dice, or you can use an open source tool like this one: https://www.rempe.us/diceware/#eff https://www.rempe.us/diceware/#eff https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
- gecko 9y agoIt's also built into 1Password. And before that, I just used what I think was literally a one- or two-line Perl script that just grabbed four words from /var/dict. Why yes, my mother's maiden name was indeed pathetic xylophone tootsie wasp, how did you know?
- developer2 9y agoThe entire point of security questions is that their answers are supposed to be things that are permanently stored in your memory, that you are physically incapable of forgetting because they are so ingrained. If you store these in a password manager, it is possible to lose them - and that is unacceptable. These are supposed to be the very last line of defense for security, including if lose your password manager. As an exaggerated analogy, imagine that being unable to answer these questions meant your house, car, and life savings are taken from you. That is how important these answers are, except you're "only" losing one online account at a time. Of course, it's terrible to use personal information that can be known to 3rd parties. It's also bad to reuse the same answers across multiple companies, as a compromise at one means you're at risk everywhere. The reason behind why security questions exist is a good one, but they don't offer enough security when used as intended (memorable, non-random data). The problem is there is currently no better alternative, short of requiring you to tie your legal identity to every account, and having to show up in person with photo ID to regain control of an account you've lost access to. Anything relying on tech (like a password manager) is a bad idea for the general public. The average person does not have multiple off-site backups to guarantee that the information is physically impossible to lose.
- andrewem 9y ago
- stordoff 9y agoI try to leave them unset where I can (probably doesn't help over the phone; I'm thinking more of online accounts), such as on eBay which keeps prompting me to set security questions but going back to the homepage lets me avoid doing so. For sites that force you to set them (and where I care - otherwise they just get random nonsense), and for my bank, I have a set of plausible but false answers I use. Not bulletproof of course, but definitely not googleable and avoids the "I just set it to something random" attack.