Hacker News Reader

Comment by iak8god | Hacker News Reader

I shares worries I've seen expressed elsewhere that this opens up a social engineering attack vector where an imposter gets through to phone support and says "oh I just typed a bunch of gibberish for the answer and can't remember it." Wouldn't a false, long, maybe hyphenated, but plausible surname be better for this reason?

View on HN

I also generate them with a password manager. FWIW, I always start with “it’s a long gibberish string” and no one has ever been satisfied with that. I’ve always had to recite it. Anecdotal I know.

Sure, but you're not spending all day running customer service "DoS attacks" against people's bank accounts. Even if "it's gibberish, and I forgot it, can't you please help me out" only works one time out of a thousand, do you really want to bet your bank balance on a weak link customer service rep who's just a tad too eager to help?

I think it’s all debatable. That human will always be a weak link. It just takes one representative to forget to ask or get convinced with “oh it’s my wife’s mother’s maiden name and my wife isn’t here and I’m in a real bind”.

But in exchange, my security answers are no longer compromisable online. I think overall it’s a positive trade off, but that’s just my hunch.

Well, for sure it's better than using your mother's actual maiden name. But I'd rather see security questions done away with altogether.

I agree, I think they’re a real problem. I think it’s possible to eliminate human error over the phone too. Perhaps design a system that doesn’t let the representative into your account until they type in the 2FA token your phone provides or something (I don’t really know, I’m far from a security expert)

I just wrote a mini rust script (https://github.com/rtaycher/make_password) to spit out 5 random dictionary words for secure passwords I need to share. Everything else gets auto generated by keepass, i should probably just figure out how to write a keepass plugin

Have you considered using the EFF's diceware wordlist? It's designed for this. https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

1Password allows you to generate word based passswords instead of random strings. I do this because it’s much easier to type manually if I’m logging into a system where I can’t copy paste from 1P

> I should probably just figure out how to write a keepass plugin

KeepassXC already has this feature [1][2]. It can also store and generate OTP codes and works with YubiKeys (similar to Bitwarden Premium).

There's also a popular Python script called xkcdpass [3] which does the same from the command-line.

[1] https://keepassxc.org/images/screenshots/windows/screen_006....

[2] https://keepassxc.org/

[3] https://github.com/redacted/XKCD-password-generator

To protect against such attacks, I write some normal English before getting to the randomness, something along the lines of “This MUST be quoted exactly or it is wrong”. That’s ~40 characters “wasted” (they’ll normally have distressingly low character limits, but I find them to normally be at least 50 characters), but I’m optimistic about it offering reasonable protection against such an attack.

In practice, I’ve never actually had to quote such a string to anything but a machine, so it is mere optimism on my part.

Reply on news.ycombinator.com