Hacker News Reader

Comment by tomkarlo | Hacker News Reader

I hate these questions. Except for some questions, like "Mother's Maiden Name", there are a lot of them where I won't answer _exactly_ the same way every time you ask me... Where did I got to college? There are three conceptually equivalent answers (abbreviation with periods, abbreviation without periods, full name) that I might be inclined to respond. Even something as simple as the name of a dog or a make of car often has multiple answers.

View on HN

This is what I really hate about secret questions. There may be many variations of the answer to a question.

Better than nothing, but that's still easily brute-forcible, even by humans.

No, it's not. I ran across one where apparently I had chosen "favorite restaurant" 10 years ago. I tried 5 likely candidates, and several passwords I use for these things. Nothing went.

But if even you can't guess the right answer, then that doesn't really count, does it? Hacker can't get access to your account, but neither can you. Might as well have entered sdaw4#$%@#$%#$5.

I'm talking about the scenario where someone either has your answer from another corrupted site, or tracks down the information publicly, like the kid who 'hacked' Palin's email.

Assuming you're using legit info, it's easy enough to try several reasonable variations of, say, University of Iowa, in the way a human would abbreviate it.

I think you're missing my point... these are very occasionally used passphrases that really aren't as easy to remember as one might think. At the same time as the article points out, they're easier than an random password to hack.

So worst of all worlds: harder to remember, easier to break.

Reply on news.ycombinator.com