Your Mother’s Maiden Name Is Not a Secret • Hacker News Board

Re: Your Mother’s Maiden Name Is Not a Secret

#71

Post by Momquist » Sat, Dec 30, 2017, 3:05 AM UTC

jjeaff wrote: post #44

kstrauser wrote: post #37

Earlier quoted context omitted.

My mother's maiden name on exactly one website is "X729gD9naatotKORNKkuV0BwSm4A8GnL". On another it's "7RQCpeaG66ffxxgEoUKwvcSZfj6hEZ3Z".

That may work in cases of online password resets, but I believe it has been demonstrated that they are not great for social engineering reasons. A hacker can just say, "oh I just mashed the keyboard for that" or worse, the agent thinks it is an error or glitch and let's the hacker in. I think best to use a real, but different last name on all your sites.

In this case a long passphrase (a la xkcd: https://xkcd.com/936/) is probably the best choice. It still looks legitimate, while being more secure than any random real name.

Re: Your Mother’s Maiden Name Is Not a Secret

#72

Post by city41 » Sat, Dec 30, 2017, 3:06 AM UTC

iak8god wrote: post #68

city41 wrote: post #62

Earlier quoted context omitted.

I think it’s all debatable. That human will always be a weak link. It just takes one representative to forget to ask or get convinced with “oh it’s my wife’s mother’s maiden name and my wife isn’t here and I’m in a real bind”. But in exchange, my security answers are no longer compromisable online. I think overall it’s a positive trade off, but that’s just my hunch.

Well, for sure it's better than using your mother's actual maiden name. But I'd rather see security questions done away with altogether.

I agree, I think they’re a real problem. I think it’s possible to eliminate human error over the phone too. Perhaps design a system that doesn’t let the representative into your account until they type in the 2FA token your phone provides or something (I don’t really know, I’m far from a security expert)

Re: Your Mother’s Maiden Name Is Not a Secret

#73

Post by rat87 » Sat, Dec 30, 2017, 3:10 AM UTC

city41 wrote: post #49

iak8god wrote: post #22

Earlier quoted context omitted.

I shares worries I've seen expressed elsewhere that this opens up a social engineering attack vector where an imposter gets through to phone support and says "oh I just typed a bunch of gibberish for the answer and can't remember it." Wouldn't a false, long, maybe hyphenated, but plausible surname be better for this reason?

I also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.

I just wrote a mini rust script (https://github.com/rtaycher/make_password) to spit out 5 random dictionary words for secure passwords I need to share. Everything else gets auto generated by keepass, i should probably just figure out how to write a keepass plugin

Re: Your Mother’s Maiden Name Is Not a Secret

#74

Post by shakna » Sat, Dec 30, 2017, 3:13 AM UTC

lathiat wrote: post #63

Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

Australia is fairly similar to this. Particularly the fee free transfers between banks (for both private and business) What’s interesting is that next year most of the banks seem to be launching an instant bank transfer system - big interbank implementation. Right now it takes generally 1 business day if you’ve transacted with that account before and 3 business days if you haven’t. I assume that’s some kind of anti f…

CommBank and NAB spear-headed instant transactions.

CommBank dropped an absolute mint on it, with a goal of sub-second transactions, with decent fraud protection.

After a bunch of talks between the big banks, and VISA and MasterCard, and a little bit to do with the ombudsmen from various government branches, it was decided to share out that architecture, including fraud protection.

The fraud protection is actually really good, and thanks to actual cooperation between the banks, reimbursement is a fairly likely scenario.

Re: Your Mother’s Maiden Name Is Not a Secret

#75

Post by germanier » Sat, Dec 30, 2017, 3:14 AM UTC

maxxxxx wrote: post #60

whyever wrote: post #51

Earlier quoted context omitted.

Paper cheques do exist in Germany.

I lived in Germany for 30 years and never had used a paper check before I came to the US. What are they used for?

Insurance companies and paper magazine publishers like using them for payouts.

I know an eccentric person that also uses them. When I cashed such a check the eyes of the employee lit up and it was shown around among the tellers after asking if that's ok (which is a bit out of the ordinary as they usually act very discreet and professional) so I'd say that's a rare thing.

Re: Your Mother’s Maiden Name Is Not a Secret

#76

Post by foobarian » Sat, Dec 30, 2017, 3:17 AM UTC

gregmac wrote: post #15

tsycho wrote: post #2

Haha, that's why I have been using a made up "mother's maiden" name for the past 5 years!

That's not really any better. If a site is hacked that has your made up name, that gets published on the carder sites [1] along with your other information (email, credit card number, phone). It may not work to get a new credit card in your name, but it can be used to reset your password on some other crappy site that uses that information for "forgot password". [1] https://krebsonsecurity.com/2017/12/the-market-for-…

Rational or not, I haven't been worried about this kind of abuse of my security form data. Instead I'm paranoid about divulging some very personal facts all over the internet, such as elementary school or details about growing up. It feels like it's exactly what various three-letter agencies might love to get their grubby hands on. As a result anything made up is enough to allay that fear.

Re: Your Mother’s Maiden Name Is Not a Secret

#77

Post by germanier » Sat, Dec 30, 2017, 3:21 AM UTC

Aardwolf wrote: post #14

zkms wrote: post #7

Earlier quoted context omitted.

> maybe a slow cobol mainframe somewhere Inter-bank money transfers in US are handled by a system that needs multiple "business days" for a transaction to be finalised so you're on the money here: https://engineering.gusto.com/how-ach-works-a-developer-pers...

Oh european banks also like to keep the money for a day. Other than that day of interest it's free though :) no 25 dollar wiring fee as seen in US

Is it still that slow? Since a few months 95% of my transactions between Germany, the Netherlands and the UK (EUR account) happen the same day. It's not like banks actually can earn interest right now anyway. If anything it costs them to hold money currently.

Re: Your Mother’s Maiden Name Is Not a Secret

#78

Post by germanier » Sat, Dec 30, 2017, 3:22 AM UTC

pedrosorio wrote: post #24

viraptor wrote: post #5

Earlier quoted context omitted.

> between european bank accounts is free Between European bank accounts in the same country. Also, not every European country, unfortunately. > paper cheques don't exist since over a decade They still do. They're very rarely used, but they can be useful for cases where you want to buy something like a car without changing the card limits.

> Between European bank accounts in the same country. Also, not every European country, unfortunately. Currently there are 34 countries in the SEPA (Single Euro Payments Area): https://en.wikipedia.org/wiki/Single_Euro_Payments_Area SEPA rules specify that you cannot charge more for transfers between different countries than you would for a local transfer. https://europa.eu/youreurope/citizens/consumers/financial-pr.…

Note that this rule doesn't apply to the whole SEPA area. Switzerland is a notorious exception, Euro SEPA transfers to there often incur a charge.

Re: Your Mother’s Maiden Name Is Not a Secret

#79

Post by Latty » Sat, Dec 30, 2017, 3:23 AM UTC

nicc wrote: post #9

My bank (Fineco) requires passwords to be 8 characters. Yup, I don't mean minimum or maximum, but exactly 8 characters. That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this. I bet huge numbers are "12345678" and "password".

> I cannot think of a single good reason to impose this.

Good? Definitely not, but my money is on CHAR(8) and a lack of understanding.

Re: Your Mother’s Maiden Name Is Not a Secret

#80

Post by doomlaser » Sat, Dec 30, 2017, 3:30 AM UTC

ChemicalWarfare wrote: post #67

_wp3r wrote: post #46

Earlier quoted context omitted.

A wire transfer(IBAN/BIC transfer) is different from an ACH transfer. ACH(EFTS in EU) in the US is generally free, but has a delay for clearing and has some mechanisms for reversal. This is primarily a digital check, and can be initiated by the receiver in that way. A wire transfer is nearly immediate by comparison and offers almost no option for reversal. This option does usually have a fee and is generally reserved…

>> but has a delay for clearing... not only is there an ODFI-clearing house - RDFI delay caused by the actual "clearing" process - the whole flow starting from the merchant->payment processor step is a sequence of nightly batches with cutoff times factored in to boot. from the merchant perspective, however, ACH payment is cheaper to process than a credit card payment and is way less likely to end up in a chargeback.

debit card transactions are all ACH then?