301–310 of 450 posts
Earlier quoted context omitted.
Man I hate those security questions with a passion. They are super weakly protected backdoors into your account. Here's how I deal with sites that require them: site: "What is your first teacher's name?" me: "'Fx| The answer is a password equivalent, so I just treat it like a password.
Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!
Earlier quoted context omitted.
I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total strangers.
I think if I had a casual conversation and they started asking what was your pets name, where did you go to school etc I'd think it a bit odd. As an aside I usually have to write down the answers I've given in a word doc and look them up if I need to do that stuff as I can't remember which memorable place it was and the like.
"Hey, how are you?"
"Pretty good. We're thinking about getting a dog so I went to the shelter this morning."
"Oh really?"
"It's tough to find one that's a good match though."
"Definitely"
"You ever have a dog?"
"Nah, wife's allergic. Had a snake as a kid though...called him Mr. Slithers."
Earlier quoted context omitted.
Any idea how it works and what makes it (supposedly) impossible for a phishing site to copy?
I think the idea is that you enter your username and the site replies with the security image that you've chosen. If the image matches, you then enter your password. By itself, this doesn't rule out a man-in-the-middle attack, but it might prevent an attacker from setting up bonkofamerica.com and using it capture valid username/password pairs "offline", which could be reused on the real site. Of course, this depends…
Earlier quoted context omitted.
This! Dilbert is a documentary not a cartoon. Devs work for businessfolk. Businessfolk have the control call the shots. Sure they'll listen to devs but get the final say.
Couch your suggestions in business terms? user engagement decreases when you don't let them save their passwords or some such drivel. honestly if you think businessfolk call all the shots, you may have a broken business relationship
It requires getting promoted to management or board level to get the ultimate decision power. Some companies are more progressive when their board chooses to be but they can always revert back if they choose or get taken over.
Earlier quoted context omitted.
then you know that your passwords aren't hashed on their servers This is the immediate alarm that went off in my head reading about this. I've never seen this before either and it sounds like an idea from someone who means well but doesn't understand what they are doing.
They could hash each combination. Probably reduces security, but not a dead giveaway.
It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.
I respond with a strong password for all security questions. It created a cute incident recently when I had to verify my account over the phone by telling the phone rep that my favorite pet's name was 'o(c:Y^u=86U@4k', or whatever. I'll give the rep credit, they didn't care the answer made sense, just that it matched their screen.
Earlier quoted context omitted.
I think if I had a casual conversation and they started asking what was your pets name, where did you go to school etc I'd think it a bit odd. As an aside I usually have to write down the answers I've given in a word doc and look them up if I need to do that stuff as I can't remember which memorable place it was and the like.
Really? I'm sure it would seem odd if someone just ran down the list of questions, but I suspect you could easily maneuver the conversation so that a casual acquaintance answers one or two of them. "Hey, how are you?" "Pretty good. We're thinking about getting a dog so I went to the shelter this morning." "Oh really?" "It's tough to find one that's a good match though." "Definitely" "You ever have a dog?" "Nah, wife'…
Earlier quoted context omitted.
This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.
> consists of our birthday + 4 digits What if you have more than 10,000 people who have the same birthday? Let alone people with similar birthplaces/gender/etc. If that's all there is to it it seems like you'd run up against a combinatorical ceiling pretty soon.
Sweden has added two million people in the last half century. In net terms, essentially all of those two million have been immigrants rather than born in Sweden. They're de-populating when you exclude immigration, because their birth rate is so low.
10,000 people per day would be like Sweden adding 1/3 to its population in the next year. That's never going to happen. They're #166 when it comes to birth rate. Based on their population gain rate, they'll need to worry about the four digit limit in about 2,000 to 3,000 years give or take.
Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature, that must be performed by a human, letter by letter, to have certain legal ramifications. It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also authorized entry. It may still be a poor engineering solution to the requirement…
That might be plausible if anyone actually thought that.
E-contracts require typing out a signature, not a random phrase.
Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature, that must be performed by a human, letter by letter, to have certain legal ramifications. It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also authorized entry. It may still be a poor engineering solution to the requirement…