Hacker News Reader

Comment by nkrisc | Hacker News Reader

Zodiac sign? Seriously? I don't know what mine is because that is not a belief system/religion I subscribe to so I had to Google it. Turns out my birthdate must be on the border because different sources have it as a different sign. They might as well ask what color my aura is.

View on HN

Better than the SS administration who ask "Where were you when 9/11 happened" or "Where were you when JFK was assassinated"...Took a screenshot of these but cant find it now. My method is picking the common questions like "what street did you grow up on" and assigning it a random/not true/or another question such as "I don't know what my favorite street is"

These are so called "security questions" for that account; the great grandparent is talking about "knowledge-based authentication," which is a different thing entirely.

The "security questions" you choose your answers, in "knowledge-based authentication" the questions and answers are generated based on the information on your credit reports and other databases, such as insurance databases. You don't make up answers, they already know the answers.

> Static KBA, also referred to as "shared secrets" or "shared secret questions", is commonly used by banks, financial services companies and e-mail providers to prove the identity of the customer before allowing account access or, as a fall-back, if the user forgets their password.

Wikipedia refers to "security questions" as "Static KBA".

Speaking of the SS Administration, I ran into an annoyance with them when trying to get a replacement SS card. They would not accept any ID for which the name did not exactly match the name in the records.

So, for example, if you always went by "Ron Weasley", having your driver's license , your utility bills, your apartment lease, your animagus registration, and so on all under that name, but your name in their records was "Ronald Weasley", you would be out of luck.

I often use "None Of Your Business Street." Works every time.

Lie about which is your sign. If the bad guy knows your birthday, they will guess the wrong sign.

This is one of those questionnaires that is generated based on your credit report and other items related to you identity. So it's extrapolated from your birthdate and probably makes it ever-so-mildly more difficult for robots to get it right than it would if it just asked for your birthdate.

And now you have to keep all of your lies straight.

Absolutely; use a password manager. This is the least bad way to go for these types of "security questions": give a plausible, but wrong, answer.

Correct is too easy to guess.

Obviously wrong will be recognised by the customer service representative, who is a kind person, and will help you out by just disabling the question (anecdotes galore for this, to the point we can call it data).

Lie, in a believable way. Put the answer in a password manager. Open your password manager up before calling any CS rep. Be a star in the security theatre. :)

Password managers solve the storage part of making security questions secure, but there's still the question of generating sufficiently random answers in the correct format.

I look forward to password managers including generators for your birth date, family tree, childhood friends, favorite color and maybe also social security number, name and address if those aren't actually required for anything. Then you can have a value for your mother's maiden name that isn't incredibly common, but nonetheless looks like an actual person's name.

I save my security questions in a password manager and just generate it. Though I've thought about instead giving answers that would serve as a message to customer service rep to actually validate it in cases of someone trying to impersonate me.

Q: Where were you on New Year's Eve in 1999? A: demand-exact-answer-over-phone

They arent asking you questions they dont know. They will ask you questions about the color of your car or streets you lived on, and they know the answers.

Someday someone will write a password manager equivalent for keeping track of one's lies.

They already know the answer from your credit report and other databases... If you answer incorrectly then you get denied opening a bank account online and you'd have to jump through extra hoops, either going to a branch or mailing documents.

Sounds... not right. What is the date?

I just now Googled Scorpio (found a sign that isn't "mine", as an example) and saw dates that varied by up to 19 days on the tail end of the Scorpio range.

Depending on the sources I scanned on the first two pages of results, the cutoff is somewhere between November 2 and November 21.

Well what is it?

Reply on news.ycombinator.com