Hacker News Reader

Comment by davidmurdoch | Hacker News Reader

I actually have the same issue with my Apple account I used back in the ipod days; they are now requiring that I answer my security question during log in. But I actually don't remember the answer to the security question, as I used to always put gibberish instead of a real answer. Back in those days these questions would only be used to reset your password, and I was confident I wouldn't forget the password. I've given up on getting that account sorted.

View on HN

Furthermore, the answers to security questions aren't always stable. "What was your first pet?" Well, I know how I answer this question because one dog in particular I sort of consider my first pet. But I can remember dogs we had before that one so my answer is a somewhat arbitrary one.

By answering honestly, you also run the risk of having anyone that knows basic facts about your life being able to really make your life difficult.

It isn't just people you cross paths with that could get into those accounts, it's scammers that want to social engineer you or have access to the numerous database leaks that are accessible to anyone with the Tor Browser installed.

The answers to security questions are essentially passwords themselves, and they should be treated as such.

It's none of anyone's business! I generate one password for the password and a second password to break into 4 char random chunks for the security questions which I record in "notes" of the password manager.

Meanwhile, in practice, when I had to do a brokerage transfer a couple months back virtually, the brokerage had a long list of security questions that they had apparently assembled from various credit reporting and other sources that I had to answer to make the transfer. The identity of my first pet or my city of birth is simply not a big concern of mine compared to the information widely available on me from all sorts of sources that I have no control over.

Reply on news.ycombinator.com