Hacker News Reader

Comment by vlovich123 | Hacker News Reader

I harden my security questions by either providing a random 32-character value from [1] or by passing the real answer through sha256 with a site-specific salt (i.e. sha256(domain name + answer)). I only do this when security questions are mandatory. Otherwise I never set them up & use U2F instead.

[1] https://passwordsgenerator.net/

View on HN

This has usability problems. I don't always remember whether I used 'dr.', 'dr', or 'drive' for a street name. I can't remember if I put a space between two words. I don't recall the capitalization I used (was it proper, or did I go with lower case because I was rushed?)

If a site is going to require precise answers (and I suppose any other method probably creates additional bugs, reduces security...), then I might as well generate random responses and put those in my password manager, too.

That's correct. I usually put them in my password manager too.

Which means that if I can get a customer service rep on the phone, I can beat your security question and take over your account, by correctly answering "It's a bunch of gibberish."

I use a couple of words of pronounceable gibberish, like merbl krasnk. Same answer for all questions. At a few sites, the answers are required to be different, so I add a letter or two to the end. All of it goes in my password manager.

Yes, it is prone to targeted social engineering but so are the questions in general. At least data breaches aren't reusable across sites so I limit the damage of that attack vector. If you have a suggestion on a better technique I'm open to hearing it.

I think the better technique is to just accept that customer service is ran by malicious idiots, and that your account can and will be compromised.

Then, the proactive thing you can do is plan for how you will deal with the fallout.

When a site requires a response to these questions, I typically provide a purely-fictional response. e.g. (not real examples)

My childhood best friend: Ender Wiggen

City I was born in: Moscow, ID

etc...

and then log the specific lie in my password manager. They work if I need to read one off to a service rep over the phone, and they are in no way connected to my personal history...

Yep, and for truly random friends, streets grew up on, cities, schools attended, first person kissed, etc, fakepersongenerator works pretty well.

[1] https://www.fakepersongenerator.com/

Tried that, pita to read those off to the support people, and they usually get one of the 32 characters wrong the first time.

More recently I’ve started changing my answers to “I don’t know” which blows people’s minds when they type it in and it works.

Reply on news.ycombinator.com