Hacker News Reader

Comment by est | Hacker News Reader

you are not supposed to type realistic answers to security questions. Its better to answer in complete unrelated ways so its not guesable

View on HN

Then why are they framed as realistic questions? Sure, the most secure way of handling them might be what you suggested, but that is not how they designed to be answered. Security questions are created to verify your identity when password does not work (e.g. when they are forgotten). Answering them in unrelated ways just create another password that will also fail under the circumstances that security questions are needed.

The problem is that security questions are fundamentally flawed. Most of them are easily guessable with a little bit of research, and because they can often be used to bypass your password they're effectively a backdoor into your account. You're generally better off using them as either a backup password (that is, not guessable even given knowledge about you), or simply not using them at all. If you forgot your password then reset it via your e-mail account. In short, don't use security questions, they're fundamentally broken.

you are not supposed to type realistic answers to security questions

Assuming that you are allowed to type an answer.

United Airlines makes you pick from a list of pre-selected answers. And some of the questions are easily worthless.

For example, one of the United "security" questions is "What is your favorite ice cream?"

How is someone who is lactose intolerant supposed to answer that? Or someone who has never had ice cream? Or someone who doesn't like any of the flavors on the list? My favorite ice cream today isn't the same as it was 20 years ago when I signed up for my frequent flyer card.

United is probably the most idiotic of those. What's my favorite sport? Well, I'm not too much into sports but I'd say... Oh, it's not on the list. How about... Also not on the list. No wonder, there's hundreds of sports out there and United didn't pay their contractors enough to make a PhD level survey of sports. OK, baseball it is.

> What is your favorite ice cream

Harvard University

Good luck teaching my mother in law how to use a password manager.

Heck, I tried teaching her to write down her passwords in a notebook, and she either keeps forgetting to write down, or she loses the notebook completely.

I would be the same as your mother in law.

Thankfully, my LastPass writes down my passwords for me and is impossible to lose physically.

I actually did that once. The rest of the security practices were so ridiculous, I set all five security questions to the same nonsensical answer. I had to go through a security flow with a support rep. at some later point, and he's asked me all five questions, each time I'm giving him exactly the same answer, and by the fifth thinking, "Really? Do you think I somehow won't get this one?"

Sounds like a well trained representative?

Ha! That's a fair point. I'll award you with another security question story, then:

I called into support. This was not my first call, but it was the first call where I was prompted for the security question by the rep. And, there was no mention that it was a security question, just "So deathanatos, what color is the dress?" (Not the actual question, of course.) I was like, "uh, what?" at which point the rep. mentioned it was the security question. I'm already logged in, so I dug around the account settings, and found that under there, the security questions and their answers were visible, so I rattled off the answer at that point.

That particular method of support contact required you to log in, too, so anyone in contact could "answer" the security question by just looking it up…

but good luck remembering those guessed answers once you need them again to get your account back

I use a password generator for the answers and save them in my password manager. One time I had to read 20 random characters to someone on the phone as a response to my favorite food

So... why not just use your password manager to record the account's actual password, so you don't need to use security questions?

Sometimes password can be reset without your asking so, or the system requires to supply both password and security questions.

A lot of sites require security questions (think banks and healthcare services).

That doesn't seem to be a reason to record the garbage answer in a password manager.

If you actually need to recover the account at some point, you might need the answers to the security questions.

I doubt a password manager to store the unrelated answers was a priority either.

Reply on news.ycombinator.com