Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't give away historic details about yourself

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 207 posts

Re: Don't give away historic details about yourself

#21

Post by jaclaz »

gregmac wrote: post #4

Underlying this, don't ever answer these stupid 'account security' questions truthfully. Better to make something up and store it in your password manager along with other account info. I'd normally be tempted to put in the same types of random passwords I normally use, eg: > What was the name of the street you grew up on? L9Pro840Of9KNIGfKD4tf8tOwTG9Dcqj Unfortunately, I've heard you can talk to customer support and…

> What was the name of the street you grew up on? L9Pro840Of9KNIGfKD4tf8tOwTG9Dcqj

Taxi (now Uber and Lyft) drivers in your city must have had lots of fun ;).

Re: Don't give away historic details about yourself

#22

Post by downer61 »

ghfbjdhhv wrote: post #12
downer61 wrote: post #8

Earlier quoted context omitted.

Hashing a salted string of "an answer" usually works. Phone operators try to ask you the question, though, and you sit there for five minutes reading off hundreds of characters, and everyone is suddenly having a bad day, which I find hilarious. The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as mise…

>The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me. The person on the other end of the phone had nothing to do with it.

My hope is that the ambient animosity seeps through, via high turn-over, leading to increased personnel costs for the organization.

In general, hopefully this uncooperative behavior adds to the general misery distributed throughout the world, and all just because security goons need to feel like they're smarter than the people subject to their policies.

Consider this, oh reader, should you have the opportunity to alter password policies for a project your working on.

Re: Don't give away historic details about yourself

#23

Post by jaclaz »

ben_w wrote: post #19
jetrink wrote: post #13

Earlier quoted context omitted.

Another option is an XKCD-inspired[1] 'correct horse battery staple' passphrase. I understand that using such passphrases in other contexts like encryption is controversial due to their relatively low entropy, but I think customer support is an ideal application for them. 1. https://xkcd.com/936/

I believe the entropy problem is only that people don’t choose words randomly. I wrote a script to do it for me, with numbers separating words because some websites demand numbers, and assuming the random number generation is suitable, it’s 73 bits of entropy. I have no idea if the random number generation is sufficient: https://github.com/BenWheatley/HighEntropyPassword

>I have no idea if the random number generation is sufficient

Sure it is, to remain in the same XKCD realm, this works fine:

https://xkcd.com/221/

More seriously, since you have your "random" numbers in non-fixed position (due to different length of the "random" strings/words and also the number themselves can be 1, 2 or three characters long), even if the built-in algorithm is not "random" enough mathematically, I don't think that it will actually affect password discoverability.

Re: Don't give away historic details about yourself

#24

Post by Jeremy1026 »

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she was baffled when I told her the question selected didn't matter, and the answer was a seemingly random alphanumeric string. I told her that I don't know her, or her machine. For now, I'll be setting it as quick, easy for me to remember, string and I'll change it to a different one when I get home.

Re: Don't give away historic details about yourself

#25

Post by jjeaff »

ghfbjdhhv wrote: post #12
downer61 wrote: post #8

Earlier quoted context omitted.

Hashing a salted string of "an answer" usually works. Phone operators try to ask you the question, though, and you sit there for five minutes reading off hundreds of characters, and everyone is suddenly having a bad day, which I find hilarious. The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as mise…

>The people that expect you to maintain retardedly formatted passwords with stupid character mixtures, and expiration/re-use rules are obstacles, and I like making them as miserable as they make me. The person on the other end of the phone had nothing to do with it.

For me, as an early stage startup, my devs are actually doing some customer service. I find it has helped our UI/UX immensly because they have to deal with all the problems directly. I actually think it is a great idea to let your developers spend at least a little bit of time each week (or day) doing customer service. It's amazing how much faster little bugs get fixed and processes get streamlined.

Re: Don't give away historic details about yourself

#26

Post by yuriyb »

I've never provided literal, logical answers to security questions, as even without sharing the answers elsewhere, the logical ones would be entirely too easy to guess.

"Make of first car?" There are only so many vehicle brands reasonably accessible in a geographical area - not hard to brute force.

"City of birth?" Common knowledge among all my friends.

It's too easy.

An appropriate answer to "Make of first car?" would be something like "red &5 Blueberry."

Re: Don't give away historic details about yourself

#27

Post by sbov »

teamhappy wrote: post #14
thefifthsetpin wrote: post #10

Earlier quoted context omitted.

I do the same. Once, a bank asked me over the phone what my high school mascot was (or whatever) to verify that I was really me. I hadn't expected them to use the question in this way, so I wasn't prepared to look up my answer. Knowing whatever randomly generated string I'd used was likely unpronounceable I answered, "I could teach you to pronounce it, but first you'd need to cut out your tongue." which they accepted…

> which they accepted That's not great.

Yeah, this is why I use "lies" rather than "randomly generated string".

Re: Don't give away historic details about yourself

#28

Post by yuriyb »

abhiminator wrote: post #5

A good idea to counteract privacy risks of this sort is to occasionally search yourself by your full name or by username (one that can be traced back to you, that is) across all major search engines and see if any of your data is out in the open in any public forum. Same goes for searching your phone numbers, physical addresses and your email address (preferably in double-quotes for an exact match) -- I discovered mi…

Google provides a way to "subscribe" to email notifications of new search results for a given term (don't have the link handy right now). I've been subscribed to results for my full name for many years, and occasionally get an email of a new mention here and there.

Re: Don't give away historic details about yourself

#29

Post by jjeaff »

fenwick67 wrote: post #6
gregmac wrote: post #4

Underlying this, don't ever answer these stupid 'account security' questions truthfully. Better to make something up and store it in your password manager along with other account info. I'd normally be tempted to put in the same types of random passwords I normally use, eg: > What was the name of the street you grew up on? L9Pro840Of9KNIGfKD4tf8tOwTG9Dcqj Unfortunately, I've heard you can talk to customer support and…

A heuristic where you transform a truthful answer might be better. i.e. your first car was a Bronco, security answer = hash('bronco'+secret).slice(6)

My issue is that most of the time, the available questions are just frustratingly dumb. I don't have a favorite song, favorite movie, or favorite food. I like lots of things and those things change over time. And seriously, favorite teacher? That's very common. How many people really have a favorite teacher.
Post reply on HN