Hacker News Reader

Comment by hermanradtke | Hacker News Reader

People are social engineering a random string when talking to customer care. The attacker says “Ah, a bunch of random characters, do I have to say it?” or even worse I have had a customer service rep look at it, laugh and say never mind.

I use “batteryhorsestaple” type of passwords stored in a password manager for the security questions. Those are easy to say over the phone and more resistant to social engineering.

View on HN

1password actually supports password generation of the 'correct horse battery staple' variety, bypassing this issue entirely.

when will 1password be hacked? genuine question. is that a worry or is there something about the implementation that makes that not a worry?

When LastPass was hacked, the way they stored data helped protect users: https://blog.lastpass.com/2015/06/lastpass-security-notice.h...

It's funny that in a topic complaining about a company who spies on it's users someone brings up Last Pass which says right in it'a TOS they spy on all your browser traffic and share that info with marketing partners

https://www.logmeininc.com/legal/privacy

it basically says they collect everything possible to collect and will use it for anything they want including sharing with 3rd parties

So that's why they want me to change my password (I've had the same one since pre-acquisition days.)

Security Answer: HelpAnImposterIsTryingToHackMe

>The attacker says “Ah, a bunch of random characters, do I have to say it?

The vast majority of users aren't using random characters, so how would they know to say that to begin with? Are you implying they try that line, idk, 10,000 times until it (maybe) works?

one idea:

attacker accesses recovery answers for site A. Sees that it is random characters. Attacker has access to site A.

Attacker phones sites B,C,D and E, trys social engineering. Attacker now has access to site B,C,D,E also.

Nah, it would go like this:

Support: what is your fathers middle name?

Hacker: Michael

Support: sorry that is wrong

Hacker: oh shoot, I forget I always put the incorrect information in this one... i can't remember, did I put a fake name or random characters? Or was this the one I put a bunch of words into?

Support: yeah, it looks like random characters... let's move on

Proper training, required. That person presumably is legally liable as they've breeched the providers security by giving information; and maybe given away PII.

This is the point of failure. This never comes to fruition.

"Computers are hard, and I'm just not very good with them!"

How about "donotgiveoutoverthephone"?

I like the idea of doing this plus the random characters.

"identity theft high risk 2fZMbjL1lLZgnS8La"

Good point. Looking at my database it seems that most of the time I just choose fake answers, and sometimes use words that don't relate to the question (e.g., "Favorite food: Manchester").

I used to use real answers but then wised up and switched to random 16-character responses. I wish there was a way to find out which services I’m vulnerable on due to my stupidly using real data, without attempting to do a password reset on all of my online accounts.

> wised up and switched to random 16-character responses

As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too.

[1] https://news.ycombinator.com/item?id=18203907

I’d love to know which businesses have such an asinine policy. Name and shame! They are basically allowing a password reset with zero authentication.

Company policy wouldn't matter as much as just getting the wrong customer service rep that is trying to be a bit too "helpful".

In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.

Any business large enough to have call centre like operations - and the cost-centre mindset that goes along - where people are underpaid and pressured to take as many calls as they can?

Naming and shaming of sufficient magnitude would put pressure to select for more strict customer service representatives. If they could get fired for doing that, they would think twice.

I think a better idea, due to the issues pointed out by others, is to use valid sounding answers but not real answers. So if your mother's maiden name is Smith, don't put f4jjedglkej. Put something like "Anderson" and then store that answer in your password manager. This is what I do in order to avoid potential social engineering or employees that are simply confused by a gibberish answer.

You can get a fair amount of entropy out of names, and there are often multiple name type questions (somebody's maiden, friend's nickname, favorite teacher). Luckily it's hard to hammer customer service reps with repeated attempts, at least until the AI for voice personal assistants get a little better.

Of course, if the customer service rep can see the plaintext, it's not particularly secure is it?

Reply on news.ycombinator.com