Hacker News Reader

Comment by apcherry | Hacker News Reader

I don't even try to make it sound legitimate. e.g. How many sisters do you have? Anyone guessing will be trying a number between 0 and 5. I use a semi-random word, colour or car I associate with my sister(s), eg. Audi. When asked for a number no one guessing will respond with a car make.

View on HN

Someone has the idea behind challenge/response.

You don't have to answer the challenge with a 100% truthful, legitimate, accurate response, because the point is to NOT provide an answer that could be guessed by framing the response in truth, or even reality. So long as you've picked one that matches with what you've preseeded, use a random word/phrase as your response.

q: What is the name of your favorite teacher? a: bumble bees in the desert

Yeah, but the key is you need to be able to remember it. Sure, you could store it somewhere, but often times the reason you are needing to use it is because you don't have access to your normal system (computer, phone) that you use to login with.

I don't recall the last time I used secret answers to get into anything. I don't perceive it as a valid way to get into an account. But the option cannot be refused... so to me it's just a security risk.

I've had to use security answers because I was locked out by systems that detected I was using an ip from a different country and so refused my correct password and were using the security questions as a kind of extra authentication.

The amount of stupidity needed to build such a system is staggering.

Reply on news.ycombinator.com