Hacker News Reader

It's also insecure to have password rules because people end up writing, printing, saving passwords in Google Docs, because they can't remember them anymore with those stupid rules.

Totally agree about the "security questions". They're just insecurity questions. Everyone knows what street I used to live on and what my previous phone numbers were.

I simply type passwords in the answers.

"What is your mother's maiden name?" - "gHk899iL@"

This is a good idea. Unfortunately if you have ever in the past (foolishly) answered these security questions honestly, you can't just now start answering them with your password, unless you keep track of which sites have your honest answers and which sites you just gave your password again.

Don't use your password. Generate random passwords for each security question and record them in your password manager.

So-called "security questions" are the dumbest security measure.

I would put a _different_ password rather than the same password. Lots of site store security question answers in plain text for csrs to verify etc.

That's a problem even if you answer honestly all the time. Does this website think my best friend's name is (example) Jake or Jacob?

My solution is just to keep those answers in the "extra notes" section of my password manager.

Did I answer "Ste-Citée" or "Ste-Citee" or "Sainte Citée" or "Sainte-Citee" or ... oh, too late, only had two chances to answer. My account is now locked.

Annoyingly,some sites have started putting limits and validations on their security question answers...

Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy.

Oh, and they referred to these security questions as "2FA."

I ran across something similar on United.

https://www.united.com/ual/en/us/account/enroll/default

Derp.

And what if you never had a pet?

I love the ones that ask about one's favourite sports team (not everyone likes sports), or first girl (or boy) friend (not everyone has dated) or first car (not everyone has ever owned a car).

I hated those questions as a kid because I had nothing to answer them with.

Imagine the site complaining that your answer has "too much entropy" to be correct...

>What I do personally is type random things as the answers, and write them down somewhere. But that doesn't improve security, it weakens it. //

It weakens it to the extent of your physical security. But in practice how many crackers are breaking in to your flat [aka condo] to find your written down security responses, unless you're famous - or a target some other way (politician?) - in which case you should have sufficient physical security to protect the written answers.

Having security questions allows users to use hard passwords without the problem of losing an account. It increases the risk of personal attacks, for sure, but I'd warrant the chance of personal attack [ie by someone who knows you (or has gone through your bins)] is minimal for most people vs. the chance of an automated online attack.

I think it's right to minimise the online attack surface at the risk of the offline one for most users.

If you're famous, answers to security questions can usually be found in the Wikipedia page about you, so you pretty much have to make them up.

For security answers I let my password manager generate a Multi Word Phrase you can easily spell out in a phone conversation. Store those in my password manager under my account. Someone told me he had to go through a converstation with Apple Support spelling out 3 random 20+ characater passwords and it was a nightmare. I immediatly switched tactic.

Regretfully Apple has an annoying bug that the dialogboxes accepts 5-word phrases, but only remember the first 32characters, 3 words or something alike. Very stressfull when you’re trying to recover a password.

I have never come across an authentication mechanism that actually required your security questions. There's always another route to restoring your password, which means that they do not serve a security function, but rather serve a convenience function, at the expense of security.

If you are willing to be brave about this then the best way of answering security questions is by typing a random string and NOT writing it down. You will never need that value again.

I once did that for a site which I didn't want anyone to recover my password to and thus break the security. I -DID- write down the actual password.

Today, years later, I still can't login to the damn payroll site because there isn't a procedure for just completely resetting the password state of the account and it wouldn't let you log in without those extra things.

Since that point I have recorded every annoying split-password (that's what the 'security questions' actually are, a forced split in the single real password)...