Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't give away historic details about yourself

krebsonsecurity.com

Post reply on HN
Print view View original

171–180 of 207 posts

Re: Don't give away historic details about yourself

#171

Post by eksemplar »

hw wrote: post #15
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.

Depends on your country doesn’t it? Where I live you need to identify yourself with your national 2factor ID if you want to do anything phone related. Both for security reasons, but also because of big brother tracking us.

But the side effect of this is that you can’t highjack a phone number unless you highjack the cell tower between it and the network.

Re: Don't give away historic details about yourself

#172

Post by doomjunky »

gregmac wrote: post #4

Underlying this, don't ever answer these stupid 'account security' questions truthfully. Better to make something up and store it in your password manager along with other account info. I'd normally be tempted to put in the same types of random passwords I normally use, eg: > What was the name of the street you grew up on? L9Pro840Of9KNIGfKD4tf8tOwTG9Dcqj Unfortunately, I've heard you can talk to customer support and…

> Unfortunately, I've heard you can talk to customer support and say things like "I think I just typed in random garbage for that" and they'll accept it.

I suggest:

- "L9Pro840Of9KNI...This.entrophy.is.intentionally...GfKD4tf8tOwTG9Dcqj"

or even better

- "Dear support agent, DON'T reset my passwort on any security question!"

I also write "passport required" on top of all my bank saving books with a ballpoint pen.

Re: Don't give away historic details about yourself

#173

Post by m0rganic »

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

The pupose of the “security question” is simple.. if a user needs to recover their password then the next best way to verify authenticity of the password reset request is to verify they know the answer to a few pieces of information they have previously shared with the service. In the age of mobile devices and 2FA, this becomes a lot less relevant but is still a very viable alternative because it’s accessible and difficult to crack if done right.

Re: Don't give away historic details about yourself

#174

Post by m0rganic »

m0rganic wrote: post #173
ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

The pupose of the “security question” is simple.. if a user needs to recover their password then the next best way to verify authenticity of the password reset request is to verify they know the answer to a few pieces of information they have previously shared with the service. In the age of mobile devices and 2FA, this becomes a lot less relevant but is still a very viable alternative because it’s accessible and dif…

also if answers to those questions alone has given you access to your account it is most certainly implemented poorly.

Typically access to the account would come in a 2nd factor form like clicking on a reset password link from an email account that is yours and previously configured for such service. Only then would you be allowed to provide a new password to recover the account. Brute force protections like ensuring only a finite amount of failed attempts are necessary.

Re: Don't give away historic details about yourself

#175

Post by solarkraft »

mighty_atomic_c wrote: post #168
derekp7 wrote: post #158

Earlier quoted context omitted.

I have a third problem -- often times, the list of questions they ask are non-sense to me. "What is your favorite food?" I don't have a favorite, and can't think of anything that I'd remember later. "What was the name of your first pet?" I never had a pet. "What was the name of your high school sweetheart?" Gee, thanks a lot for stirring up bad memories.

Just go with the snark and out in a joke answer that you will find funny. Some of my security questions are hilariously inapplicable, so the first silly, snarky thing I think up is likely to be memorable. It is also a little hard to guess unless you know me really well to an unlikely degree, and it won't stick out as much as a sore thumb in multi-choice situations.

Except too often the strings have to exactly match. That has turned out to be a problem for me with longer answers.

Re: Don't give away historic details about yourself

#176

Post by Double_a_92 »

ggg9990 wrote: post #145
jonreem wrote: post #126

Earlier quoted context omitted.

Who in the world thought this was a good idea!? I can hardly think of a less secure way to ask security questions. You should name and shame; there’s a minimum bar everyone should uphold and this is far below it.

The problem they were trying to solve is someone typing in “Woodbridge Lane” as the answer and then later typing “Wood Bridge” or “Woodbridge Ln” or “Woodbridge Ln.” when prompted. This was the wrong solution.

Because calculating a Levenshtein distance is to complicated...

Re: Don't give away historic details about yourself

#177

Post by PeterStuer »

The 'secret questions' approach is also used by my bank to 'secure the line' when you call them to unblock your pin-attempts (the card blocks after 3 wrong guesses/mistypes) on your ATM card. These aren't questions that you had to fill before, but rather questions from their CRM like the address on which you first purchased fire-insurance with them etc.

While the risk isn't great (it just gives you 3 more attempts), it still feels weird.

Re: Don't give away historic details about yourself

#178

Post by fowl2 »

shakna wrote: post #152
iamshs wrote: post #135

Earlier quoted context omitted.

Yesterday, I was logging onto Australian MyGov site, and forgot the password, it sent SMS code for reset to my mobile phone, but then would not let me proceed without answering the secret questions. I usually put last word of the question sentence as an answer itself because I can't be bothered, but it was not the case this time. Not a great experience when they threaten lock out of account, and you have to go link a…

MyGov is a dumpster fire of bad choices. Some of it is legacy - integrating systems built throughout the last three decades. Some of it is management - they fired multiple teams partway through, with 100% turnover. They also massively underfunded said teams, devoting the majority of funding to PR. Also some... Interesting technical policies, like banning version control and advocating regular backups instead. (Someth…

> banning version control

wtaf. embarrased to be aussie

Re: Don't give away historic details about yourself

#179

Post by gowld »

jackhack wrote: post #35
hw wrote: post #15

Earlier quoted context omitted.

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.

In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear. It's disgusting how twisted these criminal activities have become.

You mean how incompetent the banks have become? Everyone has a phone that can a proper 2fa app like Authenticator. using SMS is inexecusable.

Re: Don't give away historic details about yourself

#180

Post by zepolen »

MzxgckZtNqX5i wrote: post #123
cmurf wrote: post #64

Earlier quoted context omitted.

Exactly. But having to come up with fake answers to stupid questions and track them, is just proof of how bad some people are at their job. Apple still does this kind of crap. Actual questions: In what city did your parents meet? What is the first name of your best friend in high school? Recently an airport public WiFi in a major city in Europe wanted my birthdate and the agreement language said that I acknowledge ev…

One thing that really drives me crazy is that Apple asks me my security questions even if I enter my correct password because I haven't logged in for a while. I didn't saved the answers (and this is my fault) but anyway I would have done it in the KeePass database that contains also the password, so no additional security.

They do that to remind you of the security answers. Still a broken model over all.
Post reply on HN