Hacker News Reader

Comment by gumby | Hacker News Reader

Password managers help a lot. Site asks for a birthdate? Whatever I choose to enter goes in the password manager. My mother's maiden name? I guess I can reveal publicly: it's fgjlh%ngf9, so into the password manager it goes.

My password manager offers to generate a password for me; I wish it would offer to generate those other fields as well.

Turns out you can fuzz your address too when validating a credit card. Autofill should handle that.

View on HN

> My mother's maiden name? I guess I can reveal publicly: it's fgjlh%ngf9, so into the password manager it goes.

Echoing: never actually answer security questions. Always treat them as additional (super annoying) passwords.

If you do, at least give them a misleading but coherent response (my first pet: grandma).

I've bypassed my own bank's security questions by telling them "the answer to 'my favorite ___' is a bunch of gibberish letters and numbers."

Good tip, thanks

Oooooof

>Turns out you can fuzz your address too when validating a credit card.

My experience is that only your ZIP code is used, not your street address or city.

There are levels. To authorize usually only billing zip is required. For a full ACH or a “full authorization”, you need the full billing address and name to match name on card. PCI-DSS.

It depends entirely on the merchant and what checks they have enabled. Some people like authorize.net may even lower your fees/bills if you require stricter address verification for example.

KeepassDX allows you to create and copy/paste custom fields which could be used for security questions (on Android).... It doesnt generate random strings for them thought

Reply on news.ycombinator.com