Hacker News Reader

Comment by MOARDONGZPLZ | Hacker News Reader

My security question answers are also stored in my 1Pass but are not plausible or even reasonable. They’re memorable passwords.

People asking them do need an explanation though, but no chance someone could guess one because it was plausible but wrong.

View on HN

A lot of times those are read by customer service reps. You'd hope if someone called up as MOARDONGZPLZ and said wazzup I'm MOARDONGZPLZ, my security questions are all gibberish, the CSR would be all "nope, need the exact answers." But instead they could be all "yeah kewl man, they are gibberish. How much $ would you like me to transfer again?

Maybe prefix the answer with "precise match only," in all caps?

Doubt it'd actually work - remember, humans.

I think the "random but actually meaningful" route is better. If you want it to get checked, grandma's name comes off fake name generator, not line noise from a CSPRNG.

You can't "outsmart" someone whose salary is predicated on doing the most frictionless version of the work possible and still get paid.

I just generate a short set of random words.

A CSR is much more likely to expect correct or similar words than a correct or similar string of gibberish.

What street did you grow up on?

Correct Horse Battery Staple

WHat's your mothers maiden name?

Correct Horse Battery Staple

What's your favourite movie?

Correct Horse Battery Staple

Sometimes a CSR for a bank or insurance company will ask questions and expect answers based on their sata about you. Which is especially fun when it's:

1) Wrong information

2) Information you don't know, like an estranged family member's birthday

I also use generated "passwords" for security question answers because most of the questions are idiotic and easy to guess for someone who is really targeting you.

They don't need to be plausible sounding, by the way, a random string of characters is fine.

Pet's name -> probably in your Instagram

Favorite color -> Hmm let's see what clothes you wear in your selfies

Street you lived on -> Hmm they probably already breached your credit report and the idiots at Experian leak all the streets you lived on without your consent

For a while I had an account that had, as a last resort for recovery, asked me random questions about the town I grew up in. Like, “which of these roads were near your house.”

Had no idea, googled them… there’s some security theater that I don’t think anybody could have been reassured by.

I've seen a few cases where the security questions are part of a list. Something like:

> Select your favorite city:

> 1) Paris

> 2) New York

> 3) Banana

> 4) Beijing

Reply on news.ycombinator.com