Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't give away historic details about yourself

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 207 posts

Re: Don't give away historic details about yourself

#91

Post by ryannielsen »

cmurf wrote: post #64
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

Exactly. But having to come up with fake answers to stupid questions and track them, is just proof of how bad some people are at their job. Apple still does this kind of crap. Actual questions: In what city did your parents meet? What is the first name of your best friend in high school? Recently an airport public WiFi in a major city in Europe wanted my birthdate and the agreement language said that I acknowledge ev…

Apple still does this kind of crap.

Not for users who've opted into two-factor authentication: https://support.apple.com/en-us/HT204915

From the page:

Do I still need to remember any security questions?

No. With two-factor authentication, you don't need to choose or remember any security questions. Your identity is verified exclusively using your password and verification codes sent to your devices and trusted phone numbers. When you enroll in two-factor authentication, we will keep your old security questions on file for two weeks in case you need to return your account to its previous security settings. After that, they will be deleted.

Re: Don't give away historic details about yourself

#92

Post by lfowles »

StavrosK wrote: post #87
jstanley wrote: post #78

Earlier quoted context omitted.

That still doesn't stop you stumbling across an older film that you've never watched before, and then finding that you like it more than your "favourite".

Wait, you answer the question before having seen every single movie? How irresponsible.

I tried my best but the session timed out before I had even finished one movie.

Re: Don't give away historic details about yourself

#93

Post by nanomonkey »

cheschire wrote: post #60

I've been really concerned about how freely people seem to give their DNA away to testing services like 23andMe or Ancestry DNA. I just get this feeling that in the next few decades genetic code may become the pinnacle of biometrics as a part of multi-factor authentication. i.e. something I know, something I have, and something I am. And DNA databases that are potentially loosely secured, or at least secured as well…

DNA can be harvested from dead hair, skin or spit even, so anyone with access to your physical environment could obtain your DNA.

Re: Don't give away historic details about yourself

#94

Post by QasimK »

smsm42 wrote: post #47
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

The funny thing is the search space for most of these questions is so narrow. I mean, they ask for colors (how many are there? how many average person can name?), city names, personal names, baseball teams, school mascots, etc. How easy is it to compile a dictionary for all of those? Probably won't take more than a day. > I've always given false info to those, when I bother to fill them out at all Average person, not…

Honestly you need a better password manager if it doesn’t allow you to store arbitrary notes or secret question/answer pairs.

Re: Don't give away historic details about yourself

#95

Post by rdiddly »

That's why the answers to the security questions are always random strings, and the answers to the quiz questions are always "your mother."

e.g. I learned to drive stick-shift on your mother. My first pet was your mother. My special furry friend is your mother. And so forth.

Re: Don't give away historic details about yourself

#96

Post by icebraining »

jwilk wrote: post #53
ben_w wrote: post #19

Earlier quoted context omitted.

I believe the entropy problem is only that people don’t choose words randomly. I wrote a script to do it for me, with numbers separating words because some websites demand numbers, and assuming the random number generation is suitable, it’s 73 bits of entropy. I have no idea if the random number generation is sufficient: https://github.com/BenWheatley/HighEntropyPassword

I only looked at the Python part, and no, it's not good. Documentation for the random module¹ prominently warns: The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator. ¹ https://docs.python.org/2/library/random.html

I'm no cryptographer, but while the warning is valid, I don't think it's crucial here.

There are two potential sources of problem, the seed and the PRNG. The seed should be OK, because Python will use urandom as long as it's available in the system. As for the PRNG, a non-secure one shouldn't be used in encryption because it has statistically predictable behavior, but as far as I know that requires access to the ciphertext, which isn't the case here.

Still, replacing random with SystemRandom is easy and would fix the problem.

Re: Don't give away historic details about yourself

#97

Post by ghaff »

enobrev wrote: post #61
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I agree with you and for accounts that matter (bank, etc), I'll generally generate additional passwords with my PW manager for each question and store them there. That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singula…

The ones I love are those with questions like "What was the first city you visited" and they give you a multiple choice of like ten cities, none of which you may ever actually have visited.

Re: Don't give away historic details about yourself

#98

Post by pieguy »

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options! Sometimes my answer would not be shown and the correct answer is "none of the above", but otherwise my answer sticks out like a sore thumb.

Re: Don't give away historic details about yourself

#99

Post by logfromblammo »

bitwize wrote: post #81
Simon_says wrote: post #54

Earlier quoted context omitted.

Are you kidding? Those are terrible passwords, and there’s already some script kiddie out there with a password list containing the top 10 billion book, music, tv show, and movie quotes. A good password has entropy, which is not a property of the alphanumeric string but of the process used to create it. Could your password generation method plausibly have produced 2^60 alternative passwords with equal probability? Pr…

"One ring to rule them all" is a terrible password, but "the dark lord's unique jewelry" might be a good one.

"Blamm0!One ring to rule them all" would be better, in that it adds a personal salt. If your personal salt satisfies length and character class requirements by itself, so much the better.

Or maybe "One And ring in to the rule darkness them bind all, them." in that it applies a personal transformation rule.

Or do both.

It's not as secure as other methods of password generation, but makes yours more resistant to (unabridged) dictionary attacks. If an attacker learns your personal salt, they could create a special dictionary attack just for your passwords, but this is another case of not outrunning the tiger when you can outrun your friend. Far easier to run the vanilla dictionary attack against everyone else who doesn't salt/transform.

Re: Don't give away historic details about yourself

#100

Post by lurker9 »

enobrev wrote: post #61
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I agree with you and for accounts that matter (bank, etc), I'll generally generate additional passwords with my PW manager for each question and store them there. That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singula…

Bruce Springsteen - Born in the USA lifelong favorite song. (although I must say that the Eye of the Tiger comes very very close)
Post reply on HN