Hacker News Reader

Comment by lhnz | Hacker News Reader

  > The best part about this lax authentication process is
  > that one can enter any email address to retrieve the
  > PIN — it doesn’t need to be tied to an existing account
  > at Equifax. Also, when the PIN is retrieved, Equifax 
  > doesn’t bother notifying any other email addresses 
  > already on file for that consumer.

Hang on, so the attacker doesn't even need to break into somebody's email account first, they can just guess the questions and put in their own email address?! This is insane.

View on HN

Security questions in general are a farce. I've started generating random passwords for answers and storing them in my password manager. that at least helps me feel slightly more secure about how ridiculous security questions are.

> generating random passwords for answers and storing them in my password manager

My friend did this. We made a bet. I called his bank and, when challenged for the answers, laughed and said I'd mashed my keyboard and that it's all gibberish. I got through and won a free drink.

I generate random 2-4 word phrases instead of random passwords specifically for this reason.

The key is to generate incorrect answers that are reasonable matches to the question.

Like if they ask for a city, then give a city. If they ask for a name, give a name. Etc.

But not your favorite city. Very clever!

Exactly. This is the right answer to the problem. Random digits are a bad idea for the reason noted above.

Yeah, and then you have 50 places with all different question where you give incorrect answers lol. Good luck trying to recall it. IMO these questions are the worst.

You put the answers into your password manager for that account. If your password manager doesn't have at least some kind of encrypted "notes" field for each account, get a better one that does.

I do, it still sucks.

i was just thinking about this after I posted this. To be fair there's probably plenty of ways to smooth talk a customer representative. Most of these conversations end up emailing you a link to reset your password anyways, I would hope.

This implies the cs agent was able to view the password in plain text.

Yikes.

Big bank?

This is an intended part of the design of security questions. They function like passwords, but they are not conceived of as being passwords.

If the bank wasn't able to view the answers in plain text, the security questions would not be able to serve their intended purpose.

Security questions are typically stored with a reversible encryption so they can be used by CS agents.

Security questions are not a password.

Which is why security questions are a horrible idea. What good does it do to have your nicely salted and hashed password when the answers to the security questions are available in plain text and get you access to the account.

They are just equivalent to a password, as knowing the answers allows you to reset the password.

I wonder if a diceware/xkcd passphrase would work better.

I did this and once they made me read it out: “three-four-echo-alpha-two-zulu…” At the end, I felt like I just gave them the world’s longest taxi clearance.

This must have been a major hassle, but your metaphor painted such a picture it cracked me up. Maybe it was a controller who had a major personal beef with some particular pilot.

There's one particular company that always asks for these on the phone, and unfortunately I have to call them somewhat regularly. "Yes, my grandma's name is 7lIMkcblbatQ7wXrmamTHc". Interestingly, they always maintain a poker face/tone throughout this process.

I call them "insecurity questions" because they just render accounts less secure.

That wouldn't work with these, experien uses its own information about you to generate the questions and answers

This is possibly the worst implementation of a terrible idea.

Disclaimer, I work for TransUnion. The following thoughts are my own.

The theory behind this implementation is that probably no one other than you knows what the amount of the mortgage you took out in 1999 is or the size of the car loan you took out in 2015. So in theory it confirms that you are the person who the credit report belongs to. In practice it gets tricky because there are plenty of people who have super boring credit files (e.g. they only have a credit card and have never had a loan). With that kind of user you end up in the situation where the questions either ask about information that can probably be gleaned from public records or the answers end up being “none of the above.” For those users specifically it is a pretty useless solution. I remember signing up for Credit Monitoring and thinking that anyone with a passing knowledge of my life could answer the questions.

It turns out that verifying that someone is who they say they are without needing to see a valid ID is a hard problem to solve.

Is it a great solution no, but before data breaches became so common it was a somewhat reasonable solution. In today’s world though I would agree that it is a pretty terrible solution, but I don’t know how you would solve that without requiring notarization from a trusted third party that the person is for sure who they say they are.

It’s almost like we need ID check kiosks around the country that generate 1time passwords for providers that have no branch offices

Until fake kiosks start appearing.

There's a reason they tell you to never use an ATM at DEFCON...

What would these do? Fake check your ID? Give you a fake password?

ID Kiosk skimming or shimming perhaps. Some kind of MitM

I’m using answers that are deliberately (but consistently) incorrect.

Then you'll love what United Airlines used to do (still does?), which had me selecting answers from a dropdown list. Too bad if your 'favourite sport' isn't listed!

They are pretty much unacceptable according to 2017 NIST standards, and pretty much impossible to use correctly in the banks' use case.

That helps when you set the security questions yourself, which is not the case here. The security questions these companies ask you are data from your credit file (like your past addresses and creditors).

These "security questions" that Experian is asking aren't questions you previously given answers to, they are questions that are generated based on what they know about you based on your credit report and data from other databases. They might ask you about loans you have or had, people and phone numbers you are "associated" with, places you've lived, cars you've insured, etc.

The days of confirming a person's identity by testing their knowledge on the person's metadata are long past (if they ever existed in the first place).

I don't know what the best solution to this will look like, or if society will ever try to implement one. A lot of people are against having a Federal ID. A private solution will have its own set of problems.

The good news is, its the responsibility of the place that's issuing the credit to do due diligence of confirming an identity. If someone steals your private details and gets approved for a line of credit using them, life will suck for a bit while you sort it out, but you'll never actually owe that money (no matter what the debt collectors tell you).

> I don't know what the best solution to this will look like, or if society will ever try to implement one.

https://billhunt.dev/blog/2020/12/18/federal-policy-recs/#4-... (“Federal IT Policy Recommendations: 2021-2024, 4. Solve Identity Once and for All”)

(disclosure: I am not Bill, just running with their recommendations)

Thanks for linking me to this. From a high level it sounds pretty reasonable. The private sector likely wouldn't be able to implement an in-person verifying service at a national scale.

This sounds like it would be well suited to being provided by the postal service

Using USPS's normal services, mailing etc, is difficult for me at least now because of hours. Its ooen from 8:30 to 5:00 on weekdays, & I have to run in my lunch to get something done, or otherwise have to wait for saturday. Would love it to shift an hour morning or evening, like 7 to 4, or 9 to 6 or something. With this suggested in-person verification, it will be more important than ever.

This an option the German postal service provides. It works quite well. There are different levels of identity verfication available, and employees are able to complete the lower levels at your door.

An personal example I had a few years ago was signing a cellphone contract online. The postal employee delivered the sim card after verifying my identiy at the door (you can't get phone contracts without ID around here).

For the higher levels one has to go to the postal office, and it includes a bit more paperwork. These are only used for higher sums, mine was for a bigger leasing contract for my company.

> I don't know what the best solution to this will look like

Changing the law to require that banks prove beyond a reasonable doubt that they entered into a contract with you. The burden should be on the bank/creditor to prove that they extended a line of credit to you. It shouldn't be up to you to prove that you didn't.

I mean, imagine if you could hold any company liable for fraud if you received a phishing email that appeared to be from them.

Indeed, it's an incentive problem. Banks create shitty systems because when their systems fail someone else suffers.

Even the phrase "identity theft" is a misleading attempt to shift the blame, as humorously depicted in this Mitchell & Webb comedy sketch: https://www.youtube.com/watch?v=CS9ptA3Ya9E

Thx for that video.... it's great!

I believe it needs to be a person-to-person interaction.

You want a line of credit? You have to go into a physical location, get photographed, maybe a fingerprint scan. Ideally, we centralize the data.

This serves several goals: 1) It provides a huge resource bank for fraud detection. On the small scale, you can flip the records to law enforcement as soon as someone says that their identity was stolen. On a big scale, you could identify serial fraudsters-- if the same guy applies at 12 banks under 12 names, a red flag needs to go off as soon as he steps into bank No. 13.

2) It makes applying for credit a serious, conscious thing that discourages frivolous use. The Klarna/Affirm style "instant credit" disappears. I think there are many people who will be better with their money just because of the shame of going into a bank and admitting they need another credit line.

3) You have an opportunity for direct intervention. Applying for credit may be a crisis signal-- maybe te guy taking your picture has some basic training and guidance to ask "are you undergoing financial abuse by a spouse?" or "you know that you're buying into a classic 419 scam?"

You don't have to answer the questions legitimately. As long as you are able to remember the answers, that is all that matters.

One of the three's PINs are automatically set, just as the date string from when you froze your credit. Legitimately something like 20191218. You could relatively easily guess them.

One of the three removed the freeze by me just calling and asking, never providing a PIN.

One of the three was alright. I set the PIN to something of my choosing. I had to call, provide all my info and then the PIN to remove it.

The state of credit freezing across the three big companies is an absolute joke.

Reply on news.ycombinator.com