61–70 of 217 posts
Did I miss anything?
Logged in today and found: "[name], we have more information about the security incident we discovered on September 25, 2018. An unauthorized third party accessed your name, email address and phone number. We acted quickly to secure the site and took action to protect your account, and we're working closely with law enforcement to address the incident." Ridiculous.
Here are the facts:
1. A software company had a security incident.
2. They urgently resolved the issue.
3. They looked into who was impacted, and sent customized notifications letting people know how they were impacted.
None of this behavior is ridiculous. It's quite responsible. What would you expect to happen differently?
Earlier quoted context omitted.
I use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.
I do exactly the same. Big pain the few times I've had to read over the phone a giant randomized string, but the phone reps always seem to think it's funny.
You can read 'mettlograter' or 'donetrapalyn' over the phone as easily as you can type them, and they're much better than '/1a!P:l3', which has approximately the same complexity.
Facebook posting: https://newsroom.fb.com/news/2018/10/update-on-security-issu... Check if you are affected here: https://www.facebook.com/help/securitynotice (posting because it took 10+ mins to find it - many media outlets are not linking directly to it)
""" Is my Facebook account impacted by this security issue? Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts. """
Facebook posting: https://newsroom.fb.com/news/2018/10/update-on-security-issu... Check if you are affected here: https://www.facebook.com/help/securitynotice (posting because it took 10+ mins to find it - many media outlets are not linking directly to it)
FB should timestamp these articles. It happened a couple of weeks ago, or is this new news?
Earlier quoted context omitted.
I use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.
People are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even worse I have had a customer service rep look at it, laugh and say never mind. I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.
The vast majority of users aren't using random characters, so how would they know to say that to begin with? Are you implying they try that line, idk, 10,000 times until it (maybe) works?
This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that. I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name o…
I use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.
Logged in today and found: "[name], we have more information about the security incident we discovered on September 25, 2018. An unauthorized third party accessed your name, email address and phone number. We acted quickly to secure the site and took action to protect your account, and we're working closely with law enforcement to address the incident." Ridiculous.
Why is that ridiculous? Here are the facts: 1. A software company had a security incident. 2. They urgently resolved the issue. 3. They looked into who was impacted, and sent customized notifications letting people know how they were impacted. None of this behavior is ridiculous. It's quite responsible. What would you expect to happen differently?
This means the credentials from the original implementation of said feature weren't locked down to only data available from your viewable profile.
While my phone number may be available elsewhere outside of FB, I only have it tied to my account as a password reset contact.
Earlier quoted context omitted.
I use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.
People are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even worse I have had a customer service rep look at it, laugh and say never mind. I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.