Hacker News Reader

Comment by eridius | Hacker News Reader

Some time ago I started doing the random strings too. I use 1Password for everything, so I just add the questions as free-form fields to 1Password, set up password fields for the answers, and have 1Password generate (pronounceable) passwords to use as the answers.

View on HN

...then I called my bank, they asked me what was my grand mother's name and I answered "Oh it's a very long, random string". I don't remember how secure the other questions were, but she seemed satisfied with such an answer (and granted me access).

Did this really happen? I mean, you know what they say about the weakest link...

In my case, I forgot I had a randomly generated answer, gave them the real answer, and the representative got very confused when he tried to compare that to what he had in the system.

Is this a hypothetical or something that actually happened? Because if it's the latter then the rep that you talked to needs to be retrained, because that's equivalent to saying "oh it's some street in San Francisco" when asked what street you grew up on.

In any case, I have 1Password generate pronounceable passwords specifically to avoid the problem of the rep trying to compare random alphanumeric strings. 1Password can even generate random phrases of N words (e.g. xkcd passwords) which works well for this sort of thing because it's easy to say those over a phone.

It did really happen, but as I said I don't remember whether the other questions were tougher. Perhaps they allow one question to be unknown. For example, when you recover a Google account, they ask you when you've created it and the subject of your last email. among other questions. I'm pretty sure I had these ones wrong but they were apparently satisfied with my other answers.

Ah, yeah if they ask multiple questions then it would be reasonable for them to allow one wrong answer.

> Because if it's the latter then the rep that you talked to needs to be retrained.

This is kinda the point though. We can cook up the most elaborate security scheme in the world, but ultimately the keys to our accounts lie with under trained, minimum-wage call center employees.

(EDIT: and hey, I've done some grinding minimum-wage bullshit jobs, I completely understand)

Using diceware strings as the secret questions/answers is good because they are then readable and pronounceable over the phone if you ever actually have to use them.

Thats what banks here in Australia do; instead of needing everything right, they ask half a dozen questions which most need to be correct. Which is insecure, if you ask me, but the importantly weighted questions are things like "whats your account balance on <account> here?" and "what account types do you have?" which aren't public info, I guess?

Yep, same here, but to make them more "phone call friendly" rather than random pronounceable passwords I generate random two or three word phrases via sites like this: http://watchout4snakes.com/wo4snakes/Random/RandomPhrase

Will 1Password detect and autofill these or do you have to look it up?

I have to look it up. There's no way 1Password would be able to detect this. But I can look it up via the 1Password Mini window (the same thing you use to fill the password in the same place) so it's no trouble.

Reply on news.ycombinator.com