Don't give away historic details about yourself • Hacker News Board

Re: Don't give away historic details about yourself

#81

Post by bitwize » Tue, Apr 10, 2018, 7:30 PM UTC

Simon_says wrote: post #54

gnulinux wrote: post #42

Earlier quoted context omitted.

> Humans are TERRIBLE at remembering passwords This is the main problem and we created this problem. Over the last 30 years we worked so hard to make passwords weird and not even that hard for computers to try find. If your password is a sentence that you know by heart, say your favorite quote, the motto of your country, of your school, or some cool fact etc... your password would be (1) safer and (2) easier for you…

Are you kidding? Those are terrible passwords, and there’s already some script kiddie out there with a password list containing the top 10 billion book, music, tv show, and movie quotes. A good password has entropy, which is not a property of the alphanumeric string but of the process used to create it. Could your password generation method plausibly have produced 2^60 alternative passwords with equal probability? Pr…

"One ring to rule them all" is a terrible password, but "the dark lord's unique jewelry" might be a good one.

Re: Don't give away historic details about yourself

#82

Post by Dylan16807 » Tue, Apr 10, 2018, 7:31 PM UTC

gnulinux wrote: post #50

jstarfish wrote: post #44

Earlier quoted context omitted.

> Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A ME…

My problem with that is remembering and generating it. First problem is easy to solve with password managers but you still have to generate an ideally long car name with no bias. If you put some bias, then it might be backtracked. You can have a dictionary of possible car names but then you're open to attack if that dictionary is found or predictable enough that someone else can compile that list. It just doesn't fee…

A security question doesn't need to have a huge amount of entropy. It's probably not hashed in the first place, so computerized brute forcing isn't a worry. It just needs to stand up against a limited number of fake logins or password reset attempts.

Re: Don't give away historic details about yourself

#83

Post by vinceguidry » Tue, Apr 10, 2018, 7:35 PM UTC

jstarfish wrote: post #44

gnulinux wrote: post #36

Earlier quoted context omitted.

I do this too, I was told to add something like "PLEASE MATCH THIS TEXT, THIS IS NOT A RANDOM STRING" at the beginning. Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account.

> Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A ME…

To be fair, to actually exploit this the scammers would have to know you put in a random string. A human customer service process is not really subject to dictionary attacks.

Re: Don't give away historic details about yourself

#84

Post by icebraining » Tue, Apr 10, 2018, 7:35 PM UTC

makecheck wrote: post #48

simonw wrote: post #17

Earlier quoted context omitted.

I agree, secret questions are dumb... but what are the alternatives? The majority of human beings now manage important parts of their lives online, which means they have to remember passwords. Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one. Secret questions may be revoltingly insecure, but they do at least let people get ba…

No ...humans are terrible at remembering passwords given inane “security” requirements that vary from site to site . I have yet to see a site allow me to “correct horse battery staple” my password for instance (xkcd), which I’ve found very memorable.

There's an easy trick for that: you use a random password of that style, then you add some weird characters at the end to comply, like "A!5#" - but you use the same weird characters for every site, so you only need to memorize a single sequence.

Re: Don't give away historic details about yourself

#85

Post by aksss » Tue, Apr 10, 2018, 7:37 PM UTC

hw wrote: post #15

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.

I'm assuming "SMS" means true, original SMS. Most people with iPhones, for instance, are using encrypted iMessage, but the code sent to you from a service provider (Microsoft, etc) will be done over straight SMS, not iMessage. Those basic SMS messages can be intercepted by a duplicated SIM card or setting a phone up with different firmware to basically listen to everything around it, including receiving SMS messages. This is probably not casual identity theft tactics though, right? I wonder if mainstream providers shouldn't start using things like Signal and WhatsApp for the 2FA code rather than SMS.

Re: Don't give away historic details about yourself

#86

Post by Thlom » Tue, Apr 10, 2018, 7:40 PM UTC

hw wrote: post #15

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.

In Norway we have "BankID" which is a 2FA solution for authentication and digital signature. It started as a normal 2FA solution with a hardware token combined with username (social security number) and password. A few years ago they introduced a mobile solution where you don't get a SMS or get prompted by an app, but rather it's some kind of functionality on the SIM card. Very convenient and works on all banks, most finance institutions and everywhere else you need to sign things.

Re: Don't give away historic details about yourself

#87

Post by StavrosK » Tue, Apr 10, 2018, 7:41 PM UTC

jstanley wrote: post #78

StavrosK wrote: post #65

Earlier quoted context omitted.

They stop making new movies when you answer that question, thus ensuring your answer will remain valid.

That still doesn't stop you stumbling across an older film that you've never watched before, and then finding that you like it more than your "favourite".

Wait, you answer the question before having seen every single movie? How irresponsible.

Re: Don't give away historic details about yourself

#88

Post by FreeFull » Tue, Apr 10, 2018, 7:42 PM UTC

samstave wrote: post #75

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I love the following technique: Question: What was the name of your first cat? A: cat Q: what city were you born in A: city Q: what is your moms maiden name? A: name and the like.

Now that you shared it here though, someone might try this on you.

Re: Don't give away historic details about yourself

#89

Post by Dylan16807 » Tue, Apr 10, 2018, 7:45 PM UTC

tgb wrote: post #71

jwilk wrote: post #53

Earlier quoted context omitted.

I only looked at the Python part, and no, it's not good. Documentation for the random module¹ prominently warns: The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator. ¹ https://docs.python.org/2/library/random.html

Okay, I don't study this, but I don't think that's what "cryptographically secure pseudo-random number generator" means. Not all things vaguely related to cryptography are required a CSPRNG and these answers are not being used cryptographically at all in many cases (like you just reading it over the phone to the representative). Please correct me if I'm wrong.

A bog-standard RNG might generate passwords depending on what second you ran it, so an attacker can easily make a list of all the passwords generated in a specific month or year.

People have lost a lot of bitcoins this way.

It might be okay for a security question, but better safe than sorry. Just use a secure generator for everything.

Re: Don't give away historic details about yourself

#90

Post by cortesoft » Tue, Apr 10, 2018, 7:46 PM UTC

vinceguidry wrote: post #83

jstarfish wrote: post #44

Earlier quoted context omitted.

> Apparently when some very incompetent bank workers ask your security questions if the frauder says "oh it was just a random string, I do not remember" they give access to your account. This has actually worked for me more than once, so...yeah. I find nonsense/ridiculous answers to be safer than than random letters. Make and model of first car? 2047 MAIBATSU MONSTROSITY Where did you meet the love of your life? A ME…

To be fair, to actually exploit this the scammers would have to know you put in a random string. A human customer service process is not really subject to dictionary attacks.

Except customer service is often trying to help you remember, and you can guess a few times.... a scammer will say something like, "Oh man, I can't remember what I picked... sometimes I choose a random car model, but sometimes I just put random characters", and if either is true, the customer service rep might confirm it.