Hacker News Reader

Comment by OJFord | Hacker News Reader

Why is that funny or bad?

If your grandmother is living and has a single dog, as 'security questions' go that would strike me as being pretty good.

View on HN

When you want to retrieve the password for an account you created 5 years ago, but you only remember creating it between 5 and 15 years ago and you have 2 dog loving grandma's each of whom have 2-3 old doggos all the time....well, good luck in remembering and identifying the correct name of the possible 10-15 dogs

This is a case where you think of an _idealized_ grandma, and her perfectly preserved dog, `Mr. Mycroft Applebottom III`, who has been sitting on her mantlepiece since you were in gradeschool. [0]

The site doesn't have to know you're making it up.

0: Obviously, it'd be better if your idealized grandma spoke with your password generator beforehand, and therefore named her dog something less guessable, like `ff627f056c51b694e2e5d0bdc168c647`.

That's a good suggestion actually: just remember that you always ignore the question, and you've saved the actual securely generated answer as 'sitename-sec-question' or whatever.

Right but if there are six possible dogs at creation time you choose a different question.

If the answer is unique when you create it, but a new dog comes into the picture when you need to recall it, I doubt that's going to cause much of a problem. Maybe you get it wrong once and try again - you're only going through this because you already forgot your password.

Because the number of people who have a grandmother with a dog that they know the name of is very small.

Right. Exactly one grandmother with exactly one living dog and you know its name. I literally can't think of anyone I know who could answer this.

If your grandmother is alive and has one dog and you use that dog's name as the answer you are not terribly secure because this information is easy to obtain. It's only virtue is that it is, supposedly, easier for you to remember.

I'd argue this is one of the more secure questions compared to other common questions like "Your mother's maiden name" or "The make of your first car".

Exactly. I don't know how to go about finding out someone's (not personally known to me) grandmother's dog's name, but if I know someone's name then mother's maiden name is easy in the UK.

It's a bad idea to use anything that might change. For example, "What was the make of your first car?" Might be OK. "What is the make of your favorite car?" Not good, odds are decent your favorite will change between setting the answer and trying to use it.

I'll take that usability problem over the security problem of using my mother's maiden name though.

Reply on news.ycombinator.com