Hacker News Reader

Comment by koolba | Hacker News Reader

This is a nice article. Only thing missing is calling out "secret questions" as asinine.

I loathe when sites require you to set them up as it requires manually generating a series of N-length random strings (ex: eZDWzazuMw0ZzD4nKhxXXVN3) and saving the pair (question plus random text) as metadata associated with the account. Not exactly pulling teeth but it's pretty annoying to manually do that for 3-5 entries.

Even worse offenders are the sites that don't even let you enter a value in a text box but instead require you to pick from a drop down with a handful, say 10-15, of entries (cough United Airlines cough).

And the very worst offenders are the ones that, after successfully authenticating with your password, ask you for the answers to the secret questions every single time you log in (cough again United Airlines cough).

View on HN

When joining my place of employment I had to fill out my I9 electronically. The website had me set up an account to store my information, and gave me the following dropdown for my secret question: https://i.imgur.com/iOsNmIk.png . For those unwilling to click, they are:

- What is your mother's maiden name?

- What was the last school you attended?

- What color eyes did you have when you were born?

- What was the last year you attended school?

So obviously you just fill in some random string as the answer, but immediately after it you had to check a box that said that you swear under penalty of perjury that all information you put into this form is accurate... I'm sure that was intended to apply to the I9 stuff but technically it includes the secret question :[

This "protects" an account that has my social security number in it, among other things.

Could you preface your random string?

    more secure random value instead: fd0987as0fh98a0b89safhsa

You're technically not lying then.

But then you're not answering the question, which is also bad.

"my eyes were brown when I was born, and here's a random string: fd0987as0fh98a0b89safhsa"

"Value must be 10 characters or less"

Just put in the MD5 of the real answer.

Instead of "blue" put "48d6215903dff56238e52e8891380c8f"

Technically, you're not lying. :-)

Obviously this would be less effective if people did this regularly.

#3 is blue for all newborns

Apparently that's a myth:

https://www.pregnancymagazine.com/pregnancy/pregnancy-health...

> Babies of African American, Hispanic and Asian descent are usually always born with dark eyes that stay that way.

Reference isn't great but you'll see the same thing where this topic is discussed almost everywhere.

That said, it would be true for most white people.

It's nearly impossible to remember what you answered for those questions anyway. For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc?

I don't have a specific favorite movie or song. Lord knows what I entered into one of those boxes a year or two ago. Whatever it was, I bet it wasn't as secure as my password.

> For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc?

No biggie, the person telling you at length about the quirks of their first car until you mention what your first car was will happily try them all.

One of the questions my bank asks is what middle school I went to and I used my elementary school by mistake. I just listed every school I went to to the guy on the phone when trying to unlock my account. It's a good thing they also ask for SSN/amount previously in the account/who your last check was made out to and that sort of thing.

I'm of the opinion that the answer to those questions should have nothing to do with the question. Make of first car? Equilateral.

EDIT: like this https://news.ycombinator.com/item?id=14856834

A secret question asked by a bank would be a strong hint for me to take my money elsewhere. They definitely should be using one-time keys from a paper slip or some similar third factor.

Does any bank (or anyone, actually) really do this though? It's easy to say you should take your money elsewhere, but where would you actually take it?

In Finland they all do. Before mobile apps, they mailed you cards with one time passwords in them, every time you logged in you had to provide your account number and OTP. Also, every time you confirmed a payment, you had to use a random security code from said card.

These days they provide apps for phones where when you make a payment you have to open the bank app and enter your PIN to confirm the payment. Same for logging in to online banking (for which there are mobile apps as well).

Also, when making a debit/credit card payment online, you also have to confirm it with one of the aforementioned methods. You can't do anything with just the card details.

I can't believe some banks around the world use plain old passwords only...

https://en.wikipedia.org/wiki/Transaction_authentication_num...

If a bank doesn't offer something like that, but still happily does online banking, I'd take my money... anywhere else, even a mattress or the sugar jar.

Well, never put yourself in a position where you need a bank account in the US then.

My bank goes a step farther and requires me to physically show up in their branch office and verify my ID. It has to be the branch near my residence.

It's not a bother since it's a 5 minute walk but I imagine that it would be hard for anyone other than me to actually do this, they'd have to show up there and convince the people there they are actually me (and some of these people now me personally)

I'd say that this would be the optimum in security.

Answered the sibling already, but I have experience only with European banks where I don't see this happening. I have account in two banks, both of which provided a paper slip with one-time authorization codes.

One european bank I have account at uses security question, but it seems to be only used as additional layer of authentication when you make changes to your account settings (in person) and not for anything online.

Santander International do for a start.

That's a nice idea, but at least every us bank I've seen does this, so...

That's definitely a bit tougher then. I have experience only with European banks that don't do the security question theater.

I started to store them in my password manager for that very reason that months later I'd never remember exactly what I put down.

Then the next point is realizing since they are "bonus passwords" anyway you might as well randomize them and use password fields. (In the Advanced Fields properties of an entry in KeePass, for instance, you have a key-value store and when you add one the "Protect in Memory" treats the value the same as KeePass treats other passwords.)

The final realization was that these questions should probably be labeled "Phone Passwords" and in which case use something like Diceware that produces easily pronounceable over the phone passwords.

When they ask you for a first car you should answer, for example, "yellow" or "miskatonic university". When they ask for favorite music band you answer "ford". Choose random words or even random strings. Nothing related to the question itself. Just write them down. Most password managers allow you to add a notes. Of course only when you can't avoid "secret" questions... At least no one will be able to profile you and guess the answers.

Lets see, when I answered this question was I listening to heavy metal, classical, country, or... I happen to enjoy all of the above at times despite them being vastly different they are all music (or can be - I have heard examples from all 3 that are not)

I generate answers to secret questions, and store them in my password manager. They're specific to the account – “mother's maiden name” at Site A is not the same as “mother's maiden name” at Site B.

If you do this, use a password recipe that generates a small number of words instead of a large number of characters. If you ever need to use the recovery questions, it will likely be by reading them over the phone.

Apple security questions are limited to 32 characters or the like. I used 5 words answers and they where accepted but not recorded in full length :-(

One day I needed them and then I had to reverse engineer their security questions algorithm. Imagine the poor soles that aren't as technical to figure this out.

One time I was so irritated with security questions when registering online with a financial organization that I answered "I fu_____ hate these g______ fu_____ security s_____ questions" (use your imagination on the blanks) and tacked on a trailing random number string. And dutifully recorded that answer in my password manager. Done!

Well, about 3 years later, I had to complete a financial transaction over the phone. Out of the blue, the young lady asks me for my challenge answer. Oh my, I was so embarrassed by the quiet snickering and muted snorting when I read her my answer.

Someone here mentioned a while ago that such random character non-answers could potentially be bypassed by answering "oh it's just a bunch of random characters" when asked for the security question over the phone.

A plausible but incorrect answer is better I think, e. g. Q: What city were you born in?, A: Severodvinsk (a random town in Russia)

And when my hack is done,

Ha ha! begins the fun,

From Severodvinsk to Minsk to Pinsk to Omsk to Tomsk to ME the news will run!

I Lobachevsky that comment!!!

I like the ones where they not only require you to do that, but then they also require you to know the answer to those to change them, even if you know your password. A couple of AAA MMORPGs have this particular antipattern, where I've forgotten what the hell I put for these questions, and even though I have managed to remember (because at least one of them, the recovery options -suck-, to where even contacting support didn't get me back into my account, but happily I was able to derive the password I used, because it was a -weak password-), I -still- can't change those questions.

I had a priceless experience trying to get my credit report about a year ago. I haven't had a car loan since about 2009 and even then it was on auto pay. I got locked out because I wasn't able to guess whether the monthly payment was, like, $237, $253, or $312. The other thing I've run into is where I can supply an arbitrary answer, but none of the questions are applicable to my life, like "who was your favorite high school teacher". More depressing than anything else, since my answers are always nonsense anyway, but still...

Oh yeah, those are a nightmare for people with bad memory (me). I don't even know the payment amount of my loans, I create my own payment schedule, thank you very much! I couldn't even tell you my mortgage payment.

I got a tip from a friend when he had to produce past addresses and dates lived there. (Did I live on 123 Main St or 321 Main St?) Keep your credit reports and keep them handy. Refer to them for things you can't remember.

Once I got asked how old my mom was. Um... yeah, I'm honestly not sure of that. It was an age range and I guessed probably around (my age) + 25 and I got it right.

I answer all of my secret questions with 160-bits of hex encoded randomness.

So you can only use each site once then?

and some sites cough Advancial cough will show you all the answers to your secret questions in plain text once you log in

Reply on news.ycombinator.com