Let’s Kill Security Questions
techblog.bozho.net
Let’s Kill Security Questions
1–5 of 5 posts
Re: Let’s Kill Security Questions
#2> Almost any security question’s answer is guessable by doing research on the target person online.
That's why you never answer the question but use some "non sequitur" answer:
Question: what colour was your first car?
Answer: rumpelstiltskin
Re: Let’s Kill Security Questions
#3> Almost any security question’s answer is guessable by doing research on the target person online. That's why you never answer the question but use some "non sequitur" answer: Question: what colour was your first car? Answer: rumpelstiltskin
This runs afoul of the rule about telling lies — you find yourself unable to remember which lie you told where.
Re: Let’s Kill Security Questions
#4> Almost any security question’s answer is guessable by doing research on the target person online. That's why you never answer the question but use some "non sequitur" answer: Question: what colour was your first car? Answer: rumpelstiltskin
and also, this is some non-obvious practice for people who are not security experts. They answer honestly because that's what they are asked
Re: Let’s Kill Security Questions
#5Security questions can be used to reset your password. They are backup passwords. They should be treated as such: randomly generated and stored in a password manager. Different for each account. Any decent password manager will have a "notes" field or other way to store such data encrypted in the vault. Since they're almost certainly stored in plaintext on the backend, they should have at least 128 bits of entropy. 20 random printable US keyboard characters, 10 diceware words, etc.
Question: What colour was your first car?
Answer: SterilityExcitableFifthAbideEnrageGaffeHazilyRecoupSacrificeIllusive
Question: What was the first street you lived on?
Answer: G]6a)ERXnVd}`Etc.