Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't give away historic details about yourself

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 207 posts

Re: Don't give away historic details about yourself

#161

Post by osteele »

rabboRubble wrote: post #110

I use 1Password as a password vault. Some years ago, I decided to start lying for secret question answer challenges. I use 1Password to generate a string of garbage (without numbers or symbols, 25 characters long) and keep that answer in a custom field in the 1Password vault. I've tagged those entries with a security tag to find all accounts with secret Q&A information. I am paranoid about back ups because if god for…

I used to do that but sometimes you have to read them over the phone. Now I use the “Words” recipe to generate a 2-3 word answer for each field. For example, if I had to fill out my answers right now, my high school would be “Popcorn Gizzard”, my childhood friend would be “Procure Drowse”, and my first car would be “Sextant Overflow”.

Re: Don't give away historic details about yourself

#162

Post by koolba »

simonw wrote: post #17
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I agree, secret questions are dumb... but what are the alternatives? The majority of human beings now manage important parts of their lives online, which means they have to remember passwords. Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one. Secret questions may be revoltingly insecure, but they do at least let people get ba…

Trusted third parties with time lock and N of M confirmations for unlock. Nominate contacts that can jointly unlock your account after a set delay.

Re: Don't give away historic details about yourself

#163

Post by senectus1 »

shakna wrote: post #152
iamshs wrote: post #135

Earlier quoted context omitted.

Yesterday, I was logging onto Australian MyGov site, and forgot the password, it sent SMS code for reset to my mobile phone, but then would not let me proceed without answering the secret questions. I usually put last word of the question sentence as an answer itself because I can't be bothered, but it was not the case this time. Not a great experience when they threaten lock out of account, and you have to go link a…

MyGov is a dumpster fire of bad choices. Some of it is legacy - integrating systems built throughout the last three decades. Some of it is management - they fired multiple teams partway through, with 100% turnover. They also massively underfunded said teams, devoting the majority of funding to PR. Also some... Interesting technical policies, like banning version control and advocating regular backups instead. (Someth…

holy crap, NOW it makes sense.

Re: Don't give away historic details about yourself

#164

Post by znpy »

This is a bit paranoiac in my opinion, but I see the point. I mean, I cannot in all honesty say he is wrong.

My approach to this problem is, given the fact that I use a password manager[1], the following: I chose a random question from the proposed set, and then generate a random password and use it as a "secret answer". Given the fact that 99% of the time the security question will be checked by a computer, the security question effectively becomes a secondary password.

But as I write I am just realizing that the security question is probably not stored in a secure manner (salt + hash) anyway, so in the event of a data leak well that account is f*ed up anyway.

Also, this has always seemed problematic to me: my secret question is supposed to be something I "just know" but... Let's assume the question is "what was your favorite teacher at elementary school" and my answer is "Mrs Chtulu"... What if I come back in a year and instinctively type "Miss Chtulu"? Do I have to remember the spelling I used? The capitalization? What if when I was 13 i did not bother capitalizing names and surnames properly but now I do ?

--

[1] - if I happen to lose the password file, I'm probably in the middle of way bigger problems.

Re: Don't give away historic details about yourself

#165

Post by mirimir »

clairity wrote: post #125
pieguy wrote: post #98

Earlier quoted context omitted.

I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options! Sometimes my answer would not be shown and the correct answer is "none of the above", but otherwise my answer sticks out like a sore thumb.

yup, folks should give plausible but wrong answers to those questions and then put them in your password manager because you'll definitely forget.

Right. That's the obvious solution.

Re: Don't give away historic details about yourself

#166

Post by ryan-c »

gnulinux wrote: post #42
simonw wrote: post #17

Earlier quoted context omitted.

I agree, secret questions are dumb... but what are the alternatives? The majority of human beings now manage important parts of their lives online, which means they have to remember passwords. Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one. Secret questions may be revoltingly insecure, but they do at least let people get ba…

> Humans are TERRIBLE at remembering passwords This is the main problem and we created this problem. Over the last 30 years we worked so hard to make passwords weird and not even that hard for computers to try find. If your password is a sentence that you know by heart, say your favorite quote, the motto of your country, of your school, or some cool fact etc... your password would be (1) safer and (2) easier for you…

> one ring to rule them all

> may the force be with you

> call me ishmael

These are all in my password cracking dictionary.

Re: Don't give away historic details about yourself

#167

Post by Trundle »

derekp7 wrote: post #158
furyg3 wrote: post #120

Earlier quoted context omitted.

This, too, was my problem. I don't want to give out real answers to my security question for two (slightly contradictory) reasons. The first is: what if this site is hacked? Now my security question answers are floating around for use on other sites that ask similar questions. The second is: some of these questions are pretty easy to find the answer to, or guess. So I used a generated string for those questions, too.…

I have a third problem -- often times, the list of questions they ask are non-sense to me. "What is your favorite food?" I don't have a favorite, and can't think of anything that I'd remember later. "What was the name of your first pet?" I never had a pet. "What was the name of your high school sweetheart?" Gee, thanks a lot for stirring up bad memories.

Here's a fourth that was actually responsible for me starting to just use generated passwords for those as well. They told me my answer wasn't valid.

According to them, it's impossible for your mothers maiden name to have less than six characters :/

Re: Don't give away historic details about yourself

#168

Post by mighty_atomic_c »

derekp7 wrote: post #158
furyg3 wrote: post #120

Earlier quoted context omitted.

This, too, was my problem. I don't want to give out real answers to my security question for two (slightly contradictory) reasons. The first is: what if this site is hacked? Now my security question answers are floating around for use on other sites that ask similar questions. The second is: some of these questions are pretty easy to find the answer to, or guess. So I used a generated string for those questions, too.…

I have a third problem -- often times, the list of questions they ask are non-sense to me. "What is your favorite food?" I don't have a favorite, and can't think of anything that I'd remember later. "What was the name of your first pet?" I never had a pet. "What was the name of your high school sweetheart?" Gee, thanks a lot for stirring up bad memories.

Just go with the snark and out in a joke answer that you will find funny. Some of my security questions are hilariously inapplicable, so the first silly, snarky thing I think up is likely to be memorable. It is also a little hard to guess unless you know me really well to an unlikely degree, and it won't stick out as much as a sore thumb in multi-choice situations.

Re: Don't give away historic details about yourself

#169

Post by mighty_atomic_c »

Trundle wrote: post #167
derekp7 wrote: post #158

Earlier quoted context omitted.

I have a third problem -- often times, the list of questions they ask are non-sense to me. "What is your favorite food?" I don't have a favorite, and can't think of anything that I'd remember later. "What was the name of your first pet?" I never had a pet. "What was the name of your high school sweetheart?" Gee, thanks a lot for stirring up bad memories.

Here's a fourth that was actually responsible for me starting to just use generated passwords for those as well. They told me my answer wasn't valid. According to them, it's impossible for your mothers maiden name to have less than six characters :/

Oh no! My mother's maiden name is _invalid_!

Re: Don't give away historic details about yourself

#170

Post by zamalek »

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I store my automatically generated secret answers in my password manager.
Post reply on HN