Schneier on Security: Fun with Secret Questions
schneier.com
Schneier on Security: Fun with Secret Questions
1–10 of 20 posts
Re: Schneier on Security: Fun with Secret Questions
#2When I'm allowed to pick the question, I invariably pick "Which is it?", and the answer is a series of random words.
Now you know, identity thieves.
Re: Schneier on Security: Fun with Secret Questions
#3Thats brilliant. A big opportunity to introduce call centre agents to Monty Python quotes!
Re: Schneier on Security: Fun with Secret Questions
#4Original date of this article: April 30, 2010. Too bad it wasn't April 1st.
Q: What is your mother's maiden name?
A: I never use my mother's REAL maiden name in a security question; that is much too easy to look up with Google.
Re: Schneier on Security: Fun with Secret Questions
#5When I'm allowed to pick the question, I invariably pick "Which is it?", and the answer is a series of random words. Now you know, identity thieves.
Call centre: Can you please provide the answer to the secret question.
Social engineer: sigh, I know this is going to sound really strange, but I just pick random words when I set up secret questions, and I'm not sure what I used with you. If it helps, it will just be a set of random words that make no sense...
Call centre: Ok, I've spoken to my supervisor and he said that, seeing as you kind of know what it's like, and seeing as you have the name and address, I can reset your password. What number would you like me to SMS it to?
Re: Schneier on Security: Fun with Secret Questions
#6Entertaining (though I've already read this one...).
I have a more interesting game I play with bank security questions that's more useful, though -- and applies to the most common usage (where the bank provides the question to you).
Simply this -- for each question, imagine how easily you could guess the answer even knowing nothing about the account owner. I'm not talking about real analysis here, just roughly mapping out the answer space.
For example, "In what city/town did ___?" is a common question. Well, if it's a US bank, probably you're dealing with US cities, and there are fewer than 20K. (Already, whoa: a three character alphanumeric password has 10 times the possibilities). Then of course cities should be weighted by population, so since NYC is biggest... well, New York has 8.3 million of the USA's 311.6 million population, the answer to this question will be New York City about 2.6% of the time.
"What's the first name of your [specified grandparent]?" is another good one. How diverse are first names, generally, particularly a few generations back? Of course there's a long tail, but otherwise... not that diverse, and it's trivial to find stats on most common names in the early 1900s. I've never chosen this question even before I started thinking hard about security, because it was blazingly obviously a bad question -- the banks would ask for my maternal grandfather's name, and I was named after him.
Fun, no?
Re: Schneier on Security: Fun with Secret Questions
#7Entertaining (though I've already read this one...). I have a more interesting game I play with bank security questions that's more useful, though -- and applies to the most common usage (where the bank provides the question to you). Simply this -- for each question, imagine how easily you could guess the answer even knowing nothing about the account owner. I'm not talking about real analysis here, just roughly mappi…
Here is a worse one:
> What is the make of your first car?
The number of relatively common car makers is really low, and when you factor in the fact that most people don't get a really high-end car as their first car, 5 or 6 makers are going to cover a really high percentage (Ford, Chevrolet, Toyota, and Honda would cover most, I'd guess). If you factor in make AND model, we're still talking in the low hundreds of possibilities.
Good security questions are really, really hard to come up with and should, IMHO, really only be used as an addition to a password - not as a way around one.
Re: Schneier on Security: Fun with Secret Questions
#8Q: Ennyn Durin aran Moria. Pedo mellon a minno.
A: Mellon!
Re: Schneier on Security: Fun with Secret Questions
#9Entertaining (though I've already read this one...). I have a more interesting game I play with bank security questions that's more useful, though -- and applies to the most common usage (where the bank provides the question to you). Simply this -- for each question, imagine how easily you could guess the answer even knowing nothing about the account owner. I'm not talking about real analysis here, just roughly mappi…
Here is a worse one: > What is the make of your first car? The number of relatively common car makers is really low, and when you factor in the fact that most people don't get a really high-end car as their first car, 5 or 6 makers are going to cover a really high percentage (Ford, Chevrolet, Toyota, and Honda would cover most, I'd guess). If you factor in make AND model, we're still talking in the low hundreds of po…
For the same reason, this one is awful:
What is your favourite colour?
(There are lots of colour names, but most people will stick to the most common ten or so.)
Re: Schneier on Security: Fun with Secret Questions
#10While entertaining, choosing the question "What is the air speed velocity of a laden swallow?" is not particularly good security.