Don't give away historic details about yourself

Post by bitL » Wed, Apr 11, 2018, 12:38 PM UTC

lysp wrote: post #186

Trundle wrote: post #167

Earlier quoted context omitted.

Here's a fourth that was actually responsible for me starting to just use generated passwords for those as well. They told me my answer wasn't valid. According to them, it's impossible for your mothers maiden name to have less than six characters :/

Funny story - I had an old short-length insecure password on a website that I hadn't used for years. I decided to log in and change it to a randomly generated secure password. However, they had upgraded their off the shelf software some time over the last 4-5 years to a newer version. The problem was, on their password change page the "new password" field had a minimum length of 8 characters, however the "OLD passwor…

Post by nkrisc » Wed, Apr 11, 2018, 1:47 PM UTC

jonreem wrote: post #126

pieguy wrote: post #98

Earlier quoted context omitted.

I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options! Sometimes my answer would not be shown and the correct answer is "none of the above", but otherwise my answer sticks out like a sore thumb.

Who in the world thought this was a good idea!? I can hardly think of a less secure way to ask security questions. You should name and shame; there’s a minimum bar everyone should uphold and this is far below it.

Post by [deleted] » Wed, Apr 11, 2018, 2:10 PM UTC

nkrisc wrote: post #193

jonreem wrote: post #126

Earlier quoted context omitted.

Who in the world thought this was a good idea!? I can hardly think of a less secure way to ask security questions. You should name and shame; there’s a minimum bar everyone should uphold and this is far below it.

If my bank had such weak security I wouldn't want to tell the internet where I bank.

Post by chrischen » Wed, Apr 11, 2018, 2:37 PM UTC

pieguy wrote: post #98

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options! Sometimes my answer would not be shown and the correct answer is "none of the above", but otherwise my answer sticks out like a sore thumb.

Post by raverbashing » Wed, Apr 11, 2018, 3:26 PM UTC

pieguy wrote: post #98

ConceptJunkie wrote: post #2

The whole "secret question" thing seemed to me to a completely stupid idea from the start. "Hey, give us password. If you forget your password, give us a much, much less secure way to access your account." I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions…

I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options! Sometimes my answer would not be shown and the correct answer is "none of the above", but otherwise my answer sticks out like a sore thumb.