Hacker News Reader

Comment by bargl | Hacker News Reader

This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that.

I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name of the babysitter with curly finger nails. I remember that and no one can figure it out based on the internet.

View on HN

I use KeePass for password management and the way I handle this is I generate a random string for each security question answer, then just include it in the Notes field of the entry.

People are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even worse I have had a customer service rep look at it, laugh and say never mind.

I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.

Good point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "Favorite food: Manchester").

I used to use real answers but then wised up and switched to random 16-character responses. I wish there was a way to find out which services I’m vulnerable on due to my stupidly using real data, without attempting to do a password reset on all of my online accounts.

> wised up and switched to random 16-character responses

As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too.

[1] https://news.ycombinator.com/item?id=18203907

I’d love to know which businesses have such an asinine policy. Name and shame! They are basically allowing a password reset with zero authentication.

Company policy wouldn't matter as much as just getting the wrong customer service rep that is trying to be a bit too "helpful".

In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.

Any business large enough to have call centre like operations - and the cost-centre mindset that goes along - where people are underpaid and pressured to take as many calls as they can?

Naming and shaming of sufficient magnitude would put pressure to select for more strict customer service representatives. If they could get fired for doing that, they would think twice.

I think a better idea, due to the issues pointed out by others, is to use valid sounding answers but not real answers. So if your mother's maiden name is Smith, don't put f4jjedglkej. Put something like "Anderson" and then store that answer in your password manager. This is what I do in order to avoid potential social engineering or employees that are simply confused by a gibberish answer.

1password actually supports password generation of the 'correct horse battery staple' variety, bypassing this issue entirely.

when will 1password be hacked? genuine question. is that a worry or is there something about the implementation that makes that not a worry?

When LastPass was hacked, the way they stored data helped protect users: https://blog.lastpass.com/2015/06/lastpass-security-notice.h...

It's funny that in a topic complaining about a company who spies on it's users someone brings up Last Pass which says right in it'a TOS they spy on all your browser traffic and share that info with marketing partners

https://www.logmeininc.com/legal/privacy

it basically says they collect everything possible to collect and will use it for anything they want including sharing with 3rd parties

So that's why they want me to change my password (I've had the same one since pre-acquisition days.)

How about "donotgiveoutoverthephone"?

I like the idea of doing this plus the random characters.

"identity theft high risk 2fZMbjL1lLZgnS8La"

>The attacker says “Ah, a bunch of random characters, do I have to say it?

The vast majority of users aren't using random characters, so how would they know to say that to begin with? Are you implying they try that line, idk, 10,000 times until it (maybe) works?

one idea:

attacker accesses recovery answers for site A. Sees that it is random characters. Attacker has access to site A.

Attacker phones sites B,C,D and E, trys social engineering. Attacker now has access to site B,C,D,E also.

Nah, it would go like this:

Support: what is your fathers middle name?

Hacker: Michael

Support: sorry that is wrong

Hacker: oh shoot, I forget I always put the incorrect information in this one... i can't remember, did I put a fake name or random characters? Or was this the one I put a bunch of words into?

Support: yeah, it looks like random characters... let's move on

Proper training, required. That person presumably is legally liable as they've breeched the providers security by giving information; and maybe given away PII.

This is the point of failure. This never comes to fruition.

"Computers are hard, and I'm just not very good with them!"

Security Answer: HelpAnImposterIsTryingToHackMe

Of course, if the customer service rep can see the plaintext, it's not particularly secure is it?

You can get a fair amount of entropy out of names, and there are often multiple name type questions (somebody's maiden, friend's nickname, favorite teacher). Luckily it's hard to hammer customer service reps with repeated attempts, at least until the AI for voice personal assistants get a little better.

I do exactly the same.

Big pain the few times I've had to read over the phone a giant randomized string, but the phone reps always seem to think it's funny.

Use a Gasser password generator, like the one in Multics[1], to make password that are easier to pronounce, but still long and complex enough to offer some value as security challenge answers.

You can read 'mettlograter' or 'donetrapalyn' over the phone as easily as you can type them, and they're much better than '/1a!P:l3', which has approximately the same complexity.

[1] https://multicians.org/thvv/gpw-js.html

For security questions, to avoid social engineering, you are better off using real, but incorrect answers and saving those. So for favorite food, put brocolli instead of your actual favorite food and rather than nonsensical answers.

I don't understand what this buys you. If you have access to your password vault, why do you need the security questions? If you lose access to the vault, don't you lose the account?

These questions are often required to be answered and some places, like vanguard, use them as a form of 2fa. Additionally, it's possible for the bank to reset passwords for some reason (hack, error, etc) and still keep these around. The point is no longer account recovery, that's correct, but it does buy you a lot of things.

The problem is that when someone claims to be you and says they've lost your password, the security questions are sometimes the only thing preventing the customer service rep from letting them bypass the password entirely.

I use 1Password but it's not fool proof. I did fake answers for a business account then promptly forgot about it and locked myself out of the account a few months later. But yes, this is the best way to do it by far.

Security questions are IMO an awful form of account recovery, as they often use publicly available data about yourself. It's basically downgrading the security of the account more often than not.

If there are no custom security question, I use my password manager to store them and put random answers not tied to myself personally.

But you can give that answer to any question they ask. That's what fake answers are all about.

It depends, in the cases that they ask you for the answer you have control, but sometimes security question like things will just end up being personal data queries like "To what address did we send account statements in June of 2016" and if a bank (or whatever) asks questions like that to confirm identity over the phone there's no way you can compel them to do otherwise, short of taking your business elsewhere. Techniques like asking them to add a note to your account or flag it as locked... those only work if the CS people read and obey them, often times social engineering attempts will re-dail CS lines until they find someone who is tired or generally sloppy and get them to push the change through.

Fixed security questions just seem like a flawed idea anyway. When creating an account to access a significant financial service online recently, I was given a list of some 20 security questions and asked to choose 3. The problem was that 18 of them didn't apply to me or had no clear answer of the kind that I would certainly remember in the event that those questions were actually needed to prove my identity. These things are probably second only to using SMS-based 2FA for annoying security measures of questionable effectiveness being mandated by ever more services (though the new voiceprint-based 2FA is closing fast).

The hackers stole session tokens. It's not about passwords and security (well it is, but not on the user level), it's about better securing access to certain data.

Security questions are DUMB. They are the exactly same authentication mechanism as password (i.e. proving you know some piece of information). So you basically have multiple backup password in case you forgot the first one. But worse.

If you create a different password for them. Because you rarely use those answer, you won't be able to remember them when they are actually needed. If you generate them with your password manager, then when you loss your password you loss them too. If you actually answer the questions with real information, you basically created a weak password.

All in all, security questions is a terrible idea.

In my password manager, I save nonsensical answers (not a string of random characters) to built-in questions.

Wait, wait, was your high school mascot the leprous gummywormbat too?

PSA: Woah.wait. I just thought since personal data of about ~30 million people was leaked, most of them would be having Gmail accounts. So, isn't Gmail under threat too? I think GOOGLE should also issue an advisory asking people to change their security questions. Did I miss something?

Google has been actively trying to get people to stop using security questions in favour of various kinds of two-factor for quite some time now (mainly mobile phone number based stuff). They'll be fine.

I know, but many still might be using these questions right?

Or just don't use facebook.

How is this relevant? Hackers can steal recovery question answers regardless of whether web token vulnerabilities exist. And web token vulnerabilities can exist regardless of recovery question strategies.

As a kid with a newspaper round I set up a bank account and didn’t know what it meant when I was asked for my mother’s maiden name, so made up an answer. Accidental security. It is a hard problem.

What? No! Custom security questions result in stuff like:

“Am I blonde?”

“What’s my shoe size?”

“How old am I?”

“Do I have a dog?”

And of course, the answers to those are incredibly easy to guess / enumerate.

It's possibly even worse than that.

I read a comment on HN that they decided to use a random word like "banana" as the answer to a security question like "What's your mother's maiden name?" Within a couple of days, the bank called his house and spoke with a different relative to get the real answer.

I use random strings of length 32 for every security question. So it's like

Q: What's the name of your first pet?

A: pVp5TxN7htNC3B3Tae3RaPLndpLj5LeV

Reply on news.ycombinator.com