Hacker News Reader

Hacker News

Comment by NoPiece | Hacker News Reader

Parent Full thread

NoPiece

I hope everyone stops relying on security questions!

View on HN

What is your mother's maiden name?

T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

Of the Greenwich T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl's ?

I laughed too hard at this.

Which only works until you call in asking for a password reset and when they ask you the question you just say "I just hit the keyboard a bunch".

No, I pull up the answer out of 1Password and read it off to them.

Sorry, I meant to imply that the support person will hear the explanation and let you reset the password without the actual answer.

Diceware is a decent option for security questions. They work fine over the phone.

Fair enough, as I believe I've had that happen. Random string for one of my financial institutions, needed to reset something. Pull up 1PWD, with random string at the ready and...they asked me questions that could have been pulled from a copy of my credit report. I didn't ask, so I'm not entirely sure, but I wonder if they didn't look at the answer, said to themselves "fuck that" and went with Option #2.

"Charlie capital-echo lima peru capital-october..."

I thought Klathmon was pointing out say that they an attacker could say that they just mashed on the keyboard and that would be good enough for the fallible human on the other end of the phone.

Anecdotally, I had a time where I couldn't remember may answer to a secret question except that it was a type of food. I called in and the human on the other end let me reset my password with just that explanation. Take that for what you will, but it seems like if someone knows you use passwords that are random strings, they can use that to break in.

But when the security question answers are leaked in plain text, they can still use it to get into your account.

Wait until they introduce a real name policy...

I hate it when I'm asked this in person at banks and shit.

"Your mother's maiden name has four numbers in it?"

"It's a password. You should never use real answers for security questions."

It's a good strategy, but a pain when you have to tell them over the phone.

Side note: if your Apple account security questions are gibberish, your account now gets stuck in an infinite reset loop. I need to answer the security questions to reset my security questions or to reset my password. This occurs even if you have the current valid password, the questions are mandatory for all changes. The questions are also mandatory for phone support, so I’m locked out of my account even though I have the password. Great job everybody.

The answers to my security questions tend to look like "e74bd7eb-10c6-4b90-bde0-dde2ed64946e"

Your security answer is a software license key?

Easily cracked!

Or maybe a Windows CLSID.

Reply on news.ycombinator.com