Live data from Hacker News

Your Mother’s Maiden Name Is Not a Secret

nytimes.com

21–30 of 274 posts

Re: Your Mother’s Maiden Name Is Not a Secret

#21
post #3

Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.

Same. It's funny because occasionally when you call support they require you to answer one of those questions.

"That's correct, my childhood pet's name was 1xs3^&szx!@!24"

Re: Your Mother’s Maiden Name Is Not a Secret

#22
post #3

Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.

I shares worries I've seen expressed elsewhere that this opens up a social engineering attack vector where an imposter gets through to phone support and says "oh I just typed a bunch of gibberish for the answer and can't remember it." Wouldn't a false, long, maybe hyphenated, but plausible surname be better for this reason?

Re: Your Mother’s Maiden Name Is Not a Secret

#23
post #5

Earlier quoted context omitted.

> between european bank accounts is free Between European bank accounts in the same country. Also, not every European country, unfortunately. > paper cheques don't exist since over a decade They still do. They're very rarely used, but they can be useful for cases where you want to buy something like a car without changing the card limits.

> Between European bank accounts in the same country. Also, not every European country, unfortunately. As far as I know, it's free between all Eurozone countries. At least I regularly do transactions between countries, and I've never heard it costing a cent.

Transfers can be charged, and often are even within the same country. In Spain it is common to have "up to n monthly transfers for free, then you get charged x%".

Also, I've received wrong payments on a German account from French people many times, and they claim it's because their bank charges the transaction and I receive the sent amount minus fees, with no possibilities for them to specify otherwise (that's happened with dozens of different clients, so I'm very inclined to believe them).

Re: Your Mother’s Maiden Name Is Not a Secret

#24
post #5
post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

> between european bank accounts is free Between European bank accounts in the same country. Also, not every European country, unfortunately. > paper cheques don't exist since over a decade They still do. They're very rarely used, but they can be useful for cases where you want to buy something like a car without changing the card limits.

> Between European bank accounts in the same country. Also, not every European country, unfortunately.

Currently there are 34 countries in the SEPA (Single Euro Payments Area): https://en.wikipedia.org/wiki/Single_Euro_Payments_Area

SEPA rules specify that you cannot charge more for transfers between different countries than you would for a local transfer.

https://europa.eu/youreurope/citizens/consumers/financial-pr...

"If the payment is in euros or Swedish krona, they should not charge you more than they would for a national transaction of the same value in euros.

Re: Your Mother’s Maiden Name Is Not a Secret

#25
post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

While most of those points generally are true I'd say that banking in Europe is only marginally better. They still have weird, mostly paper-based processes and decades-old mainframes (though that's not necessarily a bad thing). Not long ago the 2nd factor consisted of a paper slip with enumerated transaction numbers. You'd have a hard time finding a bank that allows you to easily export data to accounting software. A…

Yeah, it's kind of weird. The positive things mentioned are definitely true, but some stuff that drove me batty in Italy:

* Your bank account is attached to a specific bank branch. Even after we moved across town, we always had to return there, like spawning salmon. Moving it seemed like we were asking them to give their children up for adoption. * The hours they were open were bad even by Italian standards. * Lots of little fees and things. Credit cards cost actual money to possess; compared to the US where you get money back if you use one sensibly.

Re: Your Mother’s Maiden Name Is Not a Secret

#26
post #3

Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.

Same. There was one time when I was forced to read it back to the phone operator. Awkward.

Re: Your Mother’s Maiden Name Is Not a Secret

#27
post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

Online banking isn’t a serious attack vector for fraud, it’s just a faster-updating alternative to a paper monthly statement. 2FA is a silly red herring in these discussions. The problem is fundamentally the transaction model where you pull money from someone’s account simply by knowing some widely-shared secret numbers. These systems are sticky due to network effects. There’s no reason to sign up for an alternative to Visa/MC or ACH when your counterparties aren’t going to.

Re: Your Mother’s Maiden Name Is Not a Secret

#28
Mother's maiden name is one of the easiest. If she's on Facebook, odds are it's listed because that's how her high school friends knew her. Alternatively, if grandma & grandpa are listed, you can go there too.

I've been presenting on these flawed questions for years. In one of my demos, we take a volunteer from the audience and we see how many of the top 10 banking questions we can answer from their public Facebook & LinkedIn profiles. I've never gotten less than 4 or more than 8.. and - as an attacker - I'd take those odds.

Re: Your Mother’s Maiden Name Is Not a Secret

#29
post #23

Earlier quoted context omitted.

> Between European bank accounts in the same country. Also, not every European country, unfortunately. As far as I know, it's free between all Eurozone countries. At least I regularly do transactions between countries, and I've never heard it costing a cent.

Transfers can be charged, and often are even within the same country. In Spain it is common to have "up to n monthly transfers for free, then you get charged x%". Also, I've received wrong payments on a German account from French people many times, and they claim it's because their bank charges the transaction and I receive the sent amount minus fees, with no possibilities for them to specify otherwise (that's happen…

> bank charges the transaction and I receive the sent amount minus fees

Sounds like horrible UX -- how would people be able to pay their bills correctly if the sent value doesn't equal the received value?

Re: Your Mother’s Maiden Name Is Not a Secret

#30
post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

While most of those points generally are true I'd say that banking in Europe is only marginally better. They still have weird, mostly paper-based processes and decades-old mainframes (though that's not necessarily a bad thing). Not long ago the 2nd factor consisted of a paper slip with enumerated transaction numbers. You'd have a hard time finding a bank that allows you to easily export data to accounting software. A…

I'm using ING DiBa in Germany and they lack a secure 2fa method. There are only two options available:

- SMS-TAN, which is vulnerable to SS7 hijacking and name spoofing.

- Index-TAN, aka the enumerated paper slip, which is only "pseudo two-factor": If you computer is pwned, it can ask you for the index matching the attacker's desired transaction.

Post reply on HN