Hacker News Reader

Comment by darklajid | Hacker News Reader

Funny timing. My in-laws (both 70+) just had to change their passwords (both using @yahoo.de email addresses) and my mother in law probably botched it / managed to type the wrong thing twice or something.

Password reset requires 2 security questions (ugh - already ugly) and while she's 100% certain that she knows the answer to both the second one isn't accepted - probably another spelling issue (think St. Marlo vs. St Marlo vs. Saint Marlo vs. Sankt Marlo vs ..).

All of this is her fault, not yahoo's. But now she's stuck. There are no ways to contact support, at all, and by now her 'resolve this problem' links already contain a "In rare cases like these, we suggest creating a new account" line.

Anecdotal moral of the story: Yahoo has no customer support at all. Migrate your elder family members away while you still can. :)

View on HN

A certain elder member of my family simply cannot remember passwords. Or that she had a password at all. Or that she had an account to see what she wanted to see. So she uses password reminders everytime she wants to log in. If you log her out from a service to login yourself she asks you why "the computer stopped working". Password reminder works well until she gets logged out from the mail account, at which point creating a new account is a great solution according to her. So now when she gets a password reminder sent you have to check multiple mail accounts and hope that she is logged in to the right one. Otherwise you need to use one mail account to gain access to another until you find the password reset link. At this stage you have to hope for that the reset link is for the right Facebook account, and not any of the duplicate accounts she created when "Facebook wasn't working".

Her comment: "What? Do I need a password for this? I hate passwords! Why do they make me use passwords?" Proceeds to klick password remainder link

True story. Would ve funny if it wasn't so tragic.

Hate to be the one pointing this out, but your relative is unfit to use online services now.

You would not let her drive, would you? Even if the car provided her more automomy, the risk of her running into another car would be too high. Why would you then let her expose herself to a world full of predators that are specifically targeting senior citizens to wipe their bank accounts?

Better to monitor her use of computers as if she was a young girl.

As long as she isn't using internet banking, is it really that much of an issue?

Assuming she doesn't fall for any scams (which is a big assumption).

Actually, she isn't that far gone. But she hates computers with a passion and treats them accordingly. I have tried for many years to teach her the concepts, but she refuses based on the premise that she thinks it's too complicated and that it "should be simpler".

Kind of reminds me of myself following useless bureaucracy.

Ok, not what I had in mind when I wrote my first comment, sorry about that.

Have you tried providing written instructions? In my opinion, for her vectors of attack, it is much less risky to have her password written down in paper somewhere on a drawer at home than have an online mess.

Ideas that might help:

* set all redundant accounts to redirect mail to a main one

* do write the identifiers and passwords on paper notes, and have her keep them, for instance, inside her wallet

I just had to convert my online bank account to their new (2nd in a year) system, which now requires five security questions. As a single man who doesn't have a "favorite" anything, this proved to be a challenge. All questions were either regarding spouses, favorite somethings, or questions about descendants which I have no clue about.

I ended up just picking random questions and setting them all to the same answer, which has nothing to do with any of the questions - something that I can't even misspell if I tried. This is going to be my new strategy moving forward.

And don't even get me started on their silly username and password "security" rules.

I use 1Password and randomly generate answers for each question and log them in the "Notes" of the account.

I'm sure other tools like KeePass have similar sections to do the same thing.

That way the answers aren't reproducible and you have them safely stored somewhere.

As an added bonus, this means someone armed with the real answers to those questions won't be able to get access.

When Sarah Palin's "personal" email was hacked during the 2008 election, the attacker used her Wikipedia page and recovery questions.[0]

[0]: http://nypost.com/2008/09/19/dem-pols-son-was-hacker/

'hacking'

"to circumvent security and break into (a network, computer, file, etc.), usually with malicious intent"

Just because they didn't impress you by finding a side channel timing attack for the password hashing algorithm used by Yahoo, doesn't make it any less of a hack.

Why spend millions investing in a network of computers to break encryption, when the key can be gained far more easily with a $20 tire wrench applied with sufficient force to the DBA's knee caps?

I do this but it poses a problem for, as an example, banking. When they ask you the answer to your security question over the phone and you don't have access to your computer/password manager. Let's say you're one of those weird people without a laptop and your account is frozen while travelling overseas.

Having a cat named 1FD362BW9L6MBOWRD23SEF43 becomes a huge problem...

That's why I like 1Password. It's on my phone, so it's accessible, and I can do "words" instead of "characters".

So, I could very well have my mother's maiden name be "panda porpoise flutist sandpile", but I understand what you're saying. It may not be for everyone, but I work in the security sector and usually over-paranoid is better than ill-prepared.

Yes, this is the right way to go. Unfortunately it is limited to the tech savvy. Also, I know somebody who needed to contact a company by phone, and he needed tell the rep his security answer. He had to read off his 20 random characters. Pretty lol.

Right? Like "what is your favorite food"... what do you mean what's my favorite food? What am I, five years old? Who the hell has a favorite food? I like pizza. I like wings. I like burgers. I like bbq ribs. Who has a single favorite food? "What street did you grow up on" like many people, we moved quite a few times when I was a kid. "What was your favorite vacation/What was your favorite concert/What is your favorite movie" change way too often for any long term kind of thing.

"What city did you meet your spouse in", "what was your first car" and "where were you born" are way too common of knowledge to work reliably. Security questions suck.

Principal.com asked me a question about which car I've owned, and gave me a list of cars with year, make, model, and trim level. I've owned at least a dozen cars, and can't remember them all, much less in that detail. Needless to say, I failed that one.

I have a similar story. I wanted to get a copy of my birth certificate sent to me. In order to do so, I had to answer some security questions, which were apparently drawn from public records.

E.g.: "what was the name of the person you bought your house from?"

Really? Not only was that transaction about 15 years earlier, but I never even met the people. They moved out of town long before their house sold. Who the fuck cares what their names were?!?! Nowadays all that stuff is done through real estate agents and title companies.

So, while filling out an online form, I'm supposed to go rummaging through 15 year old records to find the names? And what if I stored those papers offline for safekeeping (e.g. at a bank)? How long will the question on the screen remain active before it times out?

There has to be a better way of doing these things.

I ultimately ended up calling Principal. The person on the phone asked some silly questions too, but at least she let me pass on a couple. She then reset my account and sent a link to reset my password. That wouldn't be so easy with all sites, since they don't all have reachable humans.

United airlines recently switched to 5 security questions with a predefined list of acceptable answers. You get a drop down to select from.

I'm almost tempted to sign up just to see what that's about, but I'm sure I would just be torturing myself at this point. I've been going through a mortgage refi, and my bank was just the worst offender, but some of the other site from which I needed to retrieve documents were almost as bad (I'm looking at you Principal).

Think of it as a new opportunity to invent a new "favorite" at random. It will confuse whoever tries to break into your account.

Yahoo has also taken over email for Verizon, which I use. Two days ago, without warning or notice, I suddenly couldn't log into my verizon email. I called verizon customer support, and the lady had no idea why I was locked out of my account. After jumping through hoops, I was able to reset.

Yesterday, my wife (same account) was locked out as well.

I'm wondering just how big of an issue this is.

Something similar happened to me with one of my rarely-used Gmail accounts, got prompted for the security question after it took me until my 3rd attempt to get the password correct. I had set the answer to gibberish some 8 or 9 years ago, and had zero way of recovering the account. Found lots of people with similar issues on the Google product forums, all answered (not by Google employees, of course) that it was completely unrecoverable.

I wrote off the account at that point and migrated a few accounts attached, but 2 weeks later the system let me enter a phone number to be able to log in.

Moral of the story: pay for support if you want it.

If only Google would let you pay for support. Someone unintentionally locked out of their account would probably happily pay $50 to get back in.

I had to deal with this a while back because TFA was enabled on my account and I got a new phone and number at the same time so my login options were all broken, and the recovery flow didn't work for the same reasons. Thankfully this was a Google for Work account so there was a way for me to prove domain ownership and they restored my access. If this had been my personal Gmail account (not attached to the domain), I would have had no way to recover it, partly because I couldn't prove ownership so easily, but mostly because they have basically no support for personal accounts.

They do let you do that. For $60 a year, you can have 24x7 phone/email support via their Google Apps platform. No restriction on it needing to be for work AFAIK.

Interesting. I was not aware of that. Thanks

https://apps.google.com/pricing.html

Would that be the landing page? If so it asks a lot of 'company' type questions. Is there a personal landing page?

I think that's just a convenience thing. I'm fairly sure you can sign up without and they'll still give you support. I've had Google Apps for years now and it's been good.

I would say the moral of the story is you get what you pay for.

Yet who would pay for email; not sure there even an option.

Fastmail?

There's a paid option I think (I wouldn't consider that for myself, but stumbled upon it while searching for a way to solve this issue). But I'd also argue that

a) you're paying, if someone offers a free service that is shoving ads in your face all the time, tries to hijack your home page and lures you to install browser toolbars and whatnot. It isn't free, you generate revenue.

b) no service, free or not, should cause you to lose access to your data. While you might mumble "Backups! You should have those" that .. isn't exactly a decent reaction or something to tell a 70+ person either. Plus, the email address is an online identity. Tied into other services (password recovery there is now broken). Causing loss of future data, backups or not. If you provide a service like that, you should provide excellent ways to regain access to that in my world.

c) I'd probably (well, not me. I'd make her..) pay for a ticket. Given the option..

I managed to contact support myself to regain access to an Yahoo account. I remember Yahoo customer support being on Twitter to deal with these kinds of issues.

Honestly, what do you expect from support in this situation? To give someone access to an account without authentication?

Nah, I expect a human to do various things. Examples below, sorted by decreasing preference and increasing complexity:

* Compare the security question's answer with a brain vs. strict equality ("Is the answer provided by the person essentially the correct one, spelling ignored?"). Right now the account is (forever?) inaccessible although the correct answer is known. It's a name of a place. She could provide GPS coordinates. For some reason she cannot come up with her original way of answering the question and you're very heavily rate limited, so she was able to try a couple variations only.

* Potentially validate the former password (if that is stored somewhere) or metadata ("I changed the password on day X, local time was around ...")

* Ask specific questions about account access or emails (last resort, but still better than losing the account forever imo)

Reply on news.ycombinator.com