Hacker News Reader

Comment by jiggawatts | Hacker News Reader

My favourite stupidity is related to self-service password reset questions.

You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use.

I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right?

Well, I was overseas with just my phone available to me, and one of the banking apps refused to let me use my valid password without also entering my password reset answers!

They misused the value I was only expecting to need for a reset for access.

I was totally locked out of my bank account with no recourse until I got back home and could look up the gibberish string used for the answers.

View on HN

That drives me crazy, too: "Choose a password." I choose a very secure password. "Now, in case you (or anyone else) can't recall your password, choose one of the following three personal security questions that any reader of your blog will be able to answer."

I can create my own question in a way that a specific answer will immediately come to mind if I'm ever asked in the future, without any need to look anything up, and that cannot be answered by googling me. How about if you let me choose the question? "No, we are security experts who have given you three excellent options to choose from. Choose one."

A travel agent had ridiculous and not explained rules for password composition so after many many tries I ended up very angry and with a password on the lines of "how about f* you idiots" (I use a password manager too). Later I wasn't able to login and the phone support told me it was because I used profanity in the password.

I treat all security questions as if they are just an additional password. I use a password manager and store a random string for each required security question.

Yet even that becomes an social engineering attack vector, if you can talk to a human: “I just put random gibberish in there” is too likely to work.

You could possibly use generated words to prevent that. "tenably-spelt-stall-proxy" shouldn't be considered "random gibberish."

Shouldn't, but it all depends on the training and awareness of the person on the phone. Instead of "random gibberish" the attacker could just say "random words", or, if they didn't know which strategy you used, "random stuff".

The most insane security question I've encountered is on united.com where they have you select your question _and answer_ from a dropdown.

and the questions are insanely specific

It's true, I tried it out: https://imgur.com/a/cJ51inY

The list of possible answers can be very long. When they don't recognize your device, you select the answer from a subset.

And the answer’s probabilities are not equally distributed! For example for the color of the house you grew up in, there are clearly most common colors and rare colors. If they asked for house number, it would have been better.

Those are not good questions if you still live in the same place you grew up.

Using password reset questions are pretty bad as a second factor is pretty bad. It probably came from good intentions. Since you were logging in from an unusual location, the bank flagged the process for a higher level of security. I wonder if they could have used literally anything else to verify you. (My bank also lets me tell them when I'll be abroad, which would have helped with the issue.)

But it isn't as bad as those "identify which of these loans you might have used" to identify you or as bad as silently truncating a password on input (both of which I've seen). Still, pretty darn bad. Don't surprise your users!

Speaking additional factors, I wrote up a piece about all the different kinds of factors[0] and when you might use them. But NIST has the canonical list[1] as far as I'm concerned (section 5).

0: https://fusionauth.io/learn/expert-advice/authentication/mul...

1: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

> You know the type: "What's your favourite animal?", and other easily-guessed and easily obtained information hackers can use.

> I always put in some gibberish by mashing the keyboard and make sure to record them somewhere safe just in case I need a password reset. I memorise my password and that should be fine, right?

But then you have to trust that "somewhere safe" is actually as safe as you think it is.

One alternative is to use them like mnemonic code phrases. So perhaps your answer to "What's your favourite animal?" is not really an animal, but maybe Cthulhu, so as a (somewhat overkill but illustrative) example maybe the answer would be "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn"

>One alternative is to use them like mnemonic code phrases. So perhaps your answer to "What's your favourite animal?" is not really an animal, but maybe Cthulhu, so maybe the answer would be "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn"

I'd go further than that and use stuff like that for actual passwords, but with a twist.

Using that sort of thing for such questions is good, but take something you know well, like a song lyric or line from a poem and then change it subtly. For example:

   Forty score and eleventy years ago, our 
   foremothers brought forth a new abomination.

Since you're the one making this stuff up, it's easy to remember, both for passwords and for those "secret" questions.

Those are pretty much endless in possibility too:

   In the town where babby formed, there lived a 
   gal who mailed some trees.

   Ask not what who has done it in your country.  
   Ask which Lulu can do it with you.

And on and on. The only real requirement is that you know whatever it is you're adapting well. Whether that be song lyrics, movie lines, poesy, etc.

I prefer song lyrics myself, since they're usually easier to remember, and when presented with the need to recall it as a password/"secret" question, the modifications made come right back.

I imagine that wouldn't work for everyone, but it works well for me, and would also work for others.

Good luck!

Finally make those eggcorns useful!

In linguistics, an eggcorn is an idiosyncratic substitution of a word or phrase for a word or words that sound similar or identical in the speaker's dialect. The new phrase introduces a meaning that is different from the original but plausible in the same context, such as "old-timers' disease" for "Alzheimer's disease".[1] An eggcorn can be described as an intra-lingual phono-semantic matching, a matching in which the intended word and substitute are from the same language. Together with other types of same-sounding phrases, eggcorns are sometimes also referred to "oronyms".

https://en.m.wikipedia.org/wiki/Eggcorn

in my experience this inevitably be on form feild where pasting isn't allowed and you cant see what you are typing and will be case sensitive but not inform you of that. and you will get locked out on attempt 3.

Add them to the Notes field in Bitwarden

I had to tell some support guy my gibberish over the phone to get them to talk to me at all ... what a fun.

Reply on news.ycombinator.com