Hacker News Reader

Comment by slg | Hacker News Reader

A way for a company I interact with infrequently to identify me over the phone. Pin codes and secret questions are easy to forget when they can literally go years without being used. What was my favorite movie when I setup my ISP account in 2016? This leads to customer service reps that are too forgiving and are easily susceptible to social engineering.

View on HN

You'd think they would just use the same 2FA methods that are popular for logging in. 'We sent a notification, click accept on it to continue' or 'read the 6 digit authenticator code' would be re-useable for their web login and there are a ton of libraries and info that make it easy to implement.

Randomize the answers to those things, and stick them in your password manager alongside (or separate from) the log-in information.

Site asks for my mother maiden's name? Let me check "pwgen 18 1"... That'll be "Viquo4cai2gienoo2p".

That may be vulnerable to social engineering if the person on the other side accepts "I'm using a randomly generated string of letters" as an answer :). So if your password manager accepts user-provided passwords, I'd just string two or three random words together and use that as the maiden name.

Never understood those kind of "security" questions. Is the site really going to hand out access to my account if that question gets answered correctly?

Also, some sites don't allow you to not set up one, so it's like forcing users to open up a new vector to be hacked.

Charles Schwab does this with voice recognition. It certainly works, but I'm guessing its cheaper to use these legacy systems.

Reply on news.ycombinator.com