Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't give away historic details about yourself

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 207 posts

Re: Don't give away historic details about yourself

#41

Post by r00fus »

gnulinux wrote: post #36
Jeremy1026 wrote: post #24

Earlier quoted context omitted.

When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she was baffled when I told her the question selected didn't matter, and the answer was a seemingly random alphanumeric string. I told her that I don't know her, or her machine. For now, I'll be setting it as quick, easy for me to remember, string and I'll change…

I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

So use passphrases that adhere to your security requirements (upper/lower/symbol etc)

Re: Don't give away historic details about yourself

#42

Post by gnulinux »

simonw wrote: post #17
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I agree, secret questions are dumb... but what are the alternatives? The majority of human beings now manage important parts of their lives online, which means they have to remember passwords. Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one. Secret questions may be revoltingly insecure, but they do at least let people get ba…

> Humans are TERRIBLE at remembering passwords

This is the main problem and we created this problem. Over the last 30 years we worked so hard to make passwords weird and not even that hard for computers to try find. If your password is a sentence that you know by heart, say your favorite quote, the motto of your country, of your school, or some cool fact etc... your password would be (1) safer and (2) easier for you to remember. That's what I do and I never have hard time remembering my 4 to 6 word password. I just use bunch of books/movies and remember my favorite quotes. For example "one ring to rule them all" is a good password, or "may the force be with you" or "call me ishmael".

Re: Don't give away historic details about yourself

#43

Post by r00fus »

ben_w wrote: post #19
jetrink wrote: post #13

Earlier quoted context omitted.

Another option is an XKCD-inspired[1] 'correct horse battery staple' passphrase. I understand that using such passphrases in other contexts like encryption is controversial due to their relatively low entropy, but I think customer support is an ideal application for them. 1. https://xkcd.com/936/

I believe the entropy problem is only that people don’t choose words randomly. I wrote a script to do it for me, with numbers separating words because some websites demand numbers, and assuming the random number generation is suitable, it’s 73 bits of entropy. I have no idea if the random number generation is sufficient: https://github.com/BenWheatley/HighEntropyPassword

I just use one of many password managers to generate the passphrase, then enrich with symbol(s) and uppercasing.

It all gets stored in the password manager anyway...

Re: Don't give away historic details about yourself

#44

Post by jstarfish »

gnulinux wrote: post #36
Jeremy1026 wrote: post #24

Earlier quoted context omitted.

When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she was baffled when I told her the question selected didn't matter, and the answer was a seemingly random alphanumeric string. I told her that I don't know her, or her machine. For now, I'll be setting it as quick, easy for me to remember, string and I'll change…

I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

> Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

This has actually worked for me more than once, so...yeah.

I find nonsense/ridiculous answers to be safer than than random letters.

Make and model of first car? 2047 MAIBATSU MONSTROSITY

Where did you meet the love of your life? A METH-FUELED SWINGER PARTY IN A CHEAP MOTEL

etc.

Re: Don't give away historic details about yourself

#45

Post by PebblesRox »

quantumfoam wrote: post #37

I usually just do a random hash. Also, really, really hate the sites that do not allow you free form text the question itself and rather populate a bunch of commonly known ones. FFS, if you're a web developer working on security questions, let the user make up the question. Agreed though, we should just do away with this as an authentication factor.

Let the user make up a question and remind them that they might need to answer it over the phone so they don’t choose something embarrassingly personal.

Re: Don't give away historic details about yourself

#46

Post by hnaccy »

gnulinux wrote: post #36
Jeremy1026 wrote: post #24

Earlier quoted context omitted.

When I signed up for a new bank account the bank rep had me set up online banking on their computer. When she asked me for my security questions and answers she was baffled when I told her the question selected didn't matter, and the answer was a seemingly random alphanumeric string. I told her that I don't know her, or her machine. For now, I'll be setting it as quick, easy for me to remember, string and I'll change…

I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

You could have predefined mappings of characters to strings so that they appear non-random, e.g. SBNLWPXMZ -> Seattle Boston Newcastle Lagos Washington Paramaribo Xanadu Montreal Zagreb.

Re: Don't give away historic details about yourself

#47

Post by smsm42 »

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

The funny thing is the search space for most of these questions is so narrow. I mean, they ask for colors (how many are there? how many average person can name?), city names, personal names, baseball teams, school mascots, etc. How easy is it to compile a dictionary for all of those? Probably won't take more than a day.

> I've always given false info to those, when I bother to fill them out at all

Average person, not trained in using password managers, won't do it. In fact, most password managers don't support those, so you need secondary secure storage. Chances of a layperson setting up one properly and consistently using it is close to zero.

> Nevertheless, my attitude is that I'll just make sure to retain the password.

The problem is, on some sites, if you know these questions you can just reset the password. Which is insane, but unfortunately happens.

Re: Don't give away historic details about yourself

#48

Post by makecheck »

simonw wrote: post #17
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I agree, secret questions are dumb... but what are the alternatives? The majority of human beings now manage important parts of their lives online, which means they have to remember passwords. Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one. Secret questions may be revoltingly insecure, but they do at least let people get ba…

No...humans are terrible at remembering passwords given inane “security” requirements that vary from site to site.

I have yet to see a site allow me to “correct horse battery staple” my password for instance (xkcd), which I’ve found very memorable.

Re: Don't give away historic details about yourself

#50

Post by gnulinux »

jstarfish wrote: post #44
gnulinux wrote: post #36

Earlier quoted context omitted.

I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

> Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A ME…

My problem with that is remembering and generating it. First problem is easy to solve with password managers but you still have to generate an ideally long car name with no bias. If you put some bias, then it might be backtracked. You can have a dictionary of possible car names but then you're open to attack if that dictionary is found or predictable enough that someone else can compile that list. It just doesn't feel secure enough to me.
Post reply on HN