51–60 of 587 posts
Great, now I'm going to have to rename my dog.
I never pick a real answer to my security questions. It just seems pointlessly dangerous.
Earlier quoted context omitted.
I never pick a real answer to my security questions. It just seems pointlessly dangerous.
they never know that i secretly use the name of my imaginary pet from grade 1 rather than my actual first pets name.
(I may be mistaken, but I do know it was absolutely the last time I gave a company true information for security questions).
Great, now I'm going to have to rename my dog.
I never pick a real answer to my security questions. It just seems pointlessly dangerous.
Earlier quoted context omitted.
I never pick a real answer to my security questions. It just seems pointlessly dangerous.
How do you keep track of phony answers to security questions if they are different for each site? If it is the same phony answer for every site, it is not any safer to use real answers to the security questions.
Earlier quoted context omitted.
I never pick a real answer to my security questions. It just seems pointlessly dangerous.
How do you keep track of phony answers to security questions if they are different for each site? If it is the same phony answer for every site, it is not any safer to use real answers to the security questions.
it's so baffling to me that people give ALL their password to a third party, commercial, organization...
For most people, non-technical people in particular, their biggest exploit risk is they re-use the same username and password everywhere, one website gets popped and their creds get in the open, and then people use those creds to get into everything else. Anything that gets them to use unique, strong passwords for everything vastly improves their general security, even if they are using a third party, commercial orga…
Earlier quoted context omitted.
Dependency exploit would be the way for 1Password etc, which are now basically wrapped web apps.
even with everything, given the norms of lock files for even the most basic of web apps, you're still at "need to roll out a client update". Now that's not to say that something can't be sneaked into other work! But the bar is a bit higher than "take over a dependency"
Earlier quoted context omitted.
in what other tech stack is it a good idea to have all your eggs in one basket? that's why it's baffling. The convenience is outweighed by the possible loss.
What percentage of the population even thinks about "tech stacks"? That's the group of people who probably already is using something else. Everyone else is still catching up to not having a password that's just "password1234" People get their credential compromised via shared passwords way more than compromises of Lastpass or Chrome or 1Password. Sure, it's a bigger risk if your manager is compromised, but for most…
it's even worse than that. The world's most common password is... password.
Earlier quoted context omitted.
I never pick a real answer to my security questions. It just seems pointlessly dangerous.
How do you keep track of phony answers to security questions if they are different for each site? If it is the same phony answer for every site, it is not any safer to use real answers to the security questions.