Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Mother’s Maiden Name Is Not a Secret

nytimes.com

Post reply on HN
Print view View original

81–90 of 274 posts

Re: Your Mother’s Maiden Name Is Not a Secret

#81

Post by dimensi0nal »

rat87 wrote: post #73
city41 wrote: post #49

Earlier quoted context omitted.

I also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.

I just wrote a mini rust script ( https://github.com/rtaycher/make_password ) to spit out 5 random dictionary words for secure passwords I need to share. Everything else gets auto generated by keepass, i should probably just figure out how to write a keepass plugin

Have you considered using the EFF's diceware wordlist? It's designed for this. https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

Re: Your Mother’s Maiden Name Is Not a Secret

#82

Post by csours »

Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

My previous credit union had a default password of the last 4 of my Social Security number (the least secure digits of a completely insecure number).

You were not required to change the password before using online banking.

The maximum length of the password was 4 characters (thankfully you could use letters, numbers and special characters).

Re: Your Mother’s Maiden Name Is Not a Secret

#84

Post by always_good »

_2dsr wrote: post #21
ademup wrote: post #3

Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.

Same. It's funny because occasionally when you call support they require you to answer one of those questions. "That's correct, my childhood pet's name was 1xs3^&szx!@!24"

Which makes it less secure. Customer support rep may find it reasonable to dismiss it as random characters and let the attacker bypass the check entirely.

If the attacker knows it looks like gibberish, they can try "Heh, whoops, I just put in random characters at the time. Can we try something else?"

I think a false, convincing, and unlikely answer is reasonable. "My childhood dog's name was Alexander Hamilton."

Re: Your Mother’s Maiden Name Is Not a Secret

#85

Post by zhte415 »

BjoernKW wrote: post #17
Aardwolf wrote: post #4

Does anyone know the cause of the large and long standing difference in banking in US vs Europe? In europe: -for 15 or so years already, web banking has been with 2nd factor authentication (since its inception I assume). In previous decades we would get devices where you need to type numbers from its lcd screen into the webpage login. Today mobile auth apps are taking over. -I have never seen a bank have security que…

While most of those points generally are true I'd say that banking in Europe is only marginally better. They still have weird, mostly paper-based processes and decades-old mainframes (though that's not necessarily a bad thing). Not long ago the 2nd factor consisted of a paper slip with enumerated transaction numbers. You'd have a hard time finding a bank that allows you to easily export data to accounting software. A…

On APIs, PSD2 http://psd2.it/ will be a game-changer for the European banking industry. Over the past 3 years all banks have been scrambling making their customers' data JSONable.

And they've been doing this as a general-case, as systems tend to be global with local characteristics and lots of glue rather than a decade back when they were disparate and lacking glue.

So when, Singapore for example, decides it wants PSD2 too (good example test case r.e. stringent data protection from regulator and competitive market) they can roll-out quickly.

Re: Your Mother’s Maiden Name Is Not a Secret

#86

Post by 659087 »

ademup wrote: post #3

Every time I'm confronted with these types of questions I just roll my eyes and add a 'Mothers maiden name' text entry to my password manager with a 16 digit random string.

I go out of my way to come up with particularly ridiculous answers to these questions in cases where I know someone might eventually want me to answer them over the phone.

Birth city: Octopus Mainframe Z7X

Re: Your Mother’s Maiden Name Is Not a Secret

#87

Post by jtmarmon »

rat87 wrote: post #73
city41 wrote: post #49

Earlier quoted context omitted.

I also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.

I just wrote a mini rust script ( https://github.com/rtaycher/make_password ) to spit out 5 random dictionary words for secure passwords I need to share. Everything else gets auto generated by keepass, i should probably just figure out how to write a keepass plugin

1Password allows you to generate word based passswords instead of random strings. I do this because it’s much easier to type manually if I’m logging into a system where I can’t copy paste from 1P

Re: Your Mother’s Maiden Name Is Not a Secret

#88

Post by tempestn »

Best line in this article:

Then there’s the State Bank of India’s vertiginous “What is the website that you rarely visit?” which reads like a Zen koan whose purpose is to make you reflect on the unknowability of the answer.

(Although, I think it could actually be a decent one for some people; you could probably mentally associate it with a specific site and have a decent chance of remembering in the future. Not as good as random answers stored in a password manager, but better than most security questions.)

Re: Your Mother’s Maiden Name Is Not a Secret

#89

Post by tempestn »

always_good wrote: post #84
_2dsr wrote: post #21

Earlier quoted context omitted.

Same. It's funny because occasionally when you call support they require you to answer one of those questions. "That's correct, my childhood pet's name was 1xs3^&szx!@!24"

Which makes it less secure. Customer support rep may find it reasonable to dismiss it as random characters and let the attacker bypass the check entirely. If the attacker knows it looks like gibberish, they can try "Heh, whoops, I just put in random characters at the time. Can we try something else?" I think a false, convincing, and unlikely answer is reasonable. "My childhood dog's name was Alexander Hamilton."

Yeah, picking something reasonable but extremely unlikely and false, then entering it into the pw manager, seems ideal.

Re: Your Mother’s Maiden Name Is Not a Secret

#90

Post by tempestn »

nicc wrote: post #9

My bank (Fineco) requires passwords to be 8 characters. Yup, I don't mean minimum or maximum, but exactly 8 characters. That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this. I bet huge numbers are "12345678" and "password".

BMO in Canada is the same, but six characters. And although you can use alphanumeric characters, it automatically doubles as a phone banking password, so (at least at one point) they were all translated into characters 2-9 in their system. So even online, you could log in with the phone digit equivalent of your exactly 6 digit password.
Post reply on HN