Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't give away historic details about yourself

krebsonsecurity.com

Post reply on HN
Print view View original

181–190 of 207 posts

Re: Don't give away historic details about yourself

#181

Post by MzxgckZtNqX5i »

zepolen wrote: post #180
MzxgckZtNqX5i wrote: post #123

Earlier quoted context omitted.

One thing that really drives me crazy is that Apple asks me my security questions even if I enter my correct password because I haven't logged in for a while. I didn't saved the answers (and this is my fault) but anyway I would have done it in the KeePass database that contains also the password, so no additional security.

They do that to remind you of the security answers. Still a broken model over all.

They could prompt you with the security questions as some other services does for master passwords for example, but usually there's the possibility to skip it. Now I'm locked out even though I know both username and password: this is BIG logic flaw in my opinion.

Re: Don't give away historic details about yourself

#182

Post by suprfnk »

Double_a_92 wrote: post #176
ggg9990 wrote: post #145

Earlier quoted context omitted.

The problem they were trying to solve is someone typing in “Woodbridge Lane” as the answer and then later typing “Wood Bridge” or “Woodbridge Ln” or “Woodbridge Ln.” when prompted. This was the wrong solution.

Because calculating a Levenshtein distance is to complicated...

Still rather unsafe, right? "Cambridge" would be closer to "Woodbridge" than "Woodbridge Lane".

Re: Don't give away historic details about yourself

#183

Post by ben_w »

jwilk wrote: post #53
ben_w wrote: post #19

Earlier quoted context omitted.

I believe the entropy problem is only that people don’t choose words randomly. I wrote a script to do it for me, with numbers separating words because some websites demand numbers, and assuming the random number generation is suitable, it’s 73 bits of entropy. I have no idea if the random number generation is sufficient: https://github.com/BenWheatley/HighEntropyPassword

I only looked at the Python part, and no, it's not good. Documentation for the random module¹ prominently warns: The pseudo-random generators of this module should not be used for security purposes. Use os.urandom() or SystemRandom if you require a cryptographically secure pseudo-random number generator. ¹ https://docs.python.org/2/library/random.html

Thanks! I’ll update it shortly.

Re: Don't give away historic details about yourself

#184

Post by enobrev »

roywiggins wrote: post #72
enobrev wrote: post #61

Earlier quoted context omitted.

I agree with you and for accounts that matter (bank, etc), I'll generally generate additional passwords with my PW manager for each question and store them there. That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singula…

> I'll generally generate additional passwords with my PW manager for each question and store them there. You have to be a bit careful with that, since some banks like to use those answers as "second factors"* when you call them. So I've gotten in the habit of using diceware-style passphrases for those, as those work over the phone better than pure white noise passwords. *extreme air quotes

That's a good point, and a great reason to try the "make pronounceable" option on my password generator.

Re: Don't give away historic details about yourself

#185

Post by coatmatter »

enobrev wrote: post #184
roywiggins wrote: post #72

Earlier quoted context omitted.

> I'll generally generate additional passwords with my PW manager for each question and store them there. You have to be a bit careful with that, since some banks like to use those answers as "second factors"* when you call them. So I've gotten in the habit of using diceware-style passphrases for those, as those work over the phone better than pure white noise passwords. *extreme air quotes

That's a good point, and a great reason to try the "make pronounceable" option on my password generator.

KeePassXC comes with a Password Generator button in the toolbar and has a Passphrase option. Just max out the word count and choose your new favourite for each account.

Re: Don't give away historic details about yourself

#186

Post by lysp »

Trundle wrote: post #167
derekp7 wrote: post #158

Earlier quoted context omitted.

I have a third problem -- often times, the list of questions they ask are non-sense to me. "What is your favorite food?" I don't have a favorite, and can't think of anything that I'd remember later. "What was the name of your first pet?" I never had a pet. "What was the name of your high school sweetheart?" Gee, thanks a lot for stirring up bad memories.

Here's a fourth that was actually responsible for me starting to just use generated passwords for those as well. They told me my answer wasn't valid. According to them, it's impossible for your mothers maiden name to have less than six characters :/

Funny story - I had an old short-length insecure password on a website that I hadn't used for years.

I decided to log in and change it to a randomly generated secure password. However, they had upgraded their off the shelf software some time over the last 4-5 years to a newer version.

The problem was, on their password change page the "new password" field had a minimum length of 8 characters, however the "OLD password" field also had that exact same requirement.

So I put in:

* Old: 12345

* New: 717&t!1XFCWJWk!q@ut3B

* Confirm: 717&t!1XFCWJWk!q@ut3B

And got an error "your password must be 8 characters or greater".

After swearing a few times, I breakpointed and edited the javascript validation to remove the length requirement and submitted the change again - this time got a server-side error saying the same thing.

I ended up beating it by logging out, clicking "I've forgot my password" and resetting it via email.

Re: Don't give away historic details about yourself

#188

Post by fnordsensei »

Thlom wrote: post #86
hw wrote: post #15

Earlier quoted context omitted.

SMS-based 2FA should be avoided as much as possible, since there are many ways to take over a phone number and get a hold of the code. Passwords, while being a huge hassle, is probably going to be the defacto authentication mechanism for sites and services (unfortunately). Maybe some sort of distributed PKI authentication + 2FA combo would be an interesting solution, but the problem would be adoption.

In Norway we have "BankID" which is a 2FA solution for authentication and digital signature. It started as a normal 2FA solution with a hardware token combined with username (social security number) and password. A few years ago they introduced a mobile solution where you don't get a SMS or get prompted by an app, but rather it's some kind of functionality on the SIM card. Very convenient and works on all banks, most…

Lately there have been attacks on BankID in Sweden.

They call you up and pretend to be from your bank, then ask you to open your BankID app and verify your identity so that they can share some very important information with you.

You open your app, and ID yourself, thereby logging them into your bank account on their end.

Re: Don't give away historic details about yourself

#189

Post by crazygringo »

icebraining wrote: post #84
makecheck wrote: post #48

Earlier quoted context omitted.

No ...humans are terrible at remembering passwords given inane “security” requirements that vary from site to site . I have yet to see a site allow me to “correct horse battery staple” my password for instance (xkcd), which I’ve found very memorable.

There's an easy trick for that: you use a random password of that style, then you add some weird characters at the end to comply, like "A!5#" - but you use the same weird characters for every site, so you only need to memorize a single sequence.

Except for the sites which prohibit special characters, or limit to a max of 16 characters (I ran into this last week, was genuinely surprised it was still a thing).

Re: Don't give away historic details about yourself

#190

Post by maaark »

ggg9990 wrote: post #145
jonreem wrote: post #126

Earlier quoted context omitted.

Who in the world thought this was a good idea!? I can hardly think of a less secure way to ask security questions. You should name and shame; there’s a minimum bar everyone should uphold and this is far below it.

The problem they were trying to solve is someone typing in “Woodbridge Lane” as the answer and then later typing “Wood Bridge” or “Woodbridge Ln” or “Woodbridge Ln.” when prompted. This was the wrong solution.

The real problem is that "security questions" are bad security.
Post reply on HN