Hacker News Reader

Comment by lisper | Hacker News Reader

Another criterion for a good security question: make sure everyone actually has an answer. I use a website that forces me to answer the following question: in what month was your first child born? It boggles my mind that someone at this company could fail to consider the possibility that a user of their site might not have children.

View on HN

That's kinda funny to me. For people like me (and likely a lot of others that browse this site) the answer to how many children you have, is clearly "@#T%FGDw34dsd$"

Giving answers like this over the phone to customer services reps is always a good laugh.

CSR: “Wait, what’s your favorite city?”

Me: “jeogusbw378fnsbwxwobp”

CSR: “Is that in Europe?”

Huh. I only have "monkey ((( banana B4N4N4 banana" kids. I should probably switch to an automated child enumeration reminder program, to keep track of how many kids I had when I signed up for different accounts.

Or that this information is known by other people too.

I’ve similarly encountered mandatory security questions making US-specific cultural assumptions that simply do not translate internationally. “Name of your prom date” and “Favourite middle school teacher” for example.

I have a pin code that I use to answer any and all security questions. I feel just as (in)secure using it versus the real answers, and I don't have to remember which "real" answer I chose when setting it (or whether I capitalized any words, etc.). I suppose I should start using random, incorrect answers and keeping them in my password manager, but I haven't got around to that.

That's exactly what I do. I generate "passwords" for the answers and record them in the password manager.

This particular site forces me to choose a month from a dropdown menu.

Or worse. Dead children.

Reply on news.ycombinator.com