Hacker News Reader

Comment by haberman | Hacker News Reader

Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question.

I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining about security questions a bunch):

"Just got challenged with a security question, which was "Thank you for your loan application." Wtf, that is not a question. And I've never filled out any security questions for this website, so I have no idea what it's expecting me to enter.

"I swear, security questions are out to get me."

View on HN

Plus, you should never answer security questions honestly. Your favorite pet or the street you grew up on or your mother's maiden name are all not secret information. Many of my friends and family know the answers to all of these. So, when faced with a security question, I try to pick a random (but false) security answer, which I then write down in an encrypted file. This is a terrible solution, but it feels foolish to answer the questions honestly.

Security questions are usually just used to decide whether to send you an email with a password reset link (or more annoyingly, a new password), aren't they? I've never seen a system where being able to answer the security question(s) is equivalent to knowing your password. Anyone who knows my mother's maiden name probably also knows my email address and could more easily spam me directly than using a website to send me password reset links.

You are mostly correct and thus it is generally safe to use accurate answers. But, sadly, I have seen some systems skip the email step.

Yes, but if you compromise email then they become easily guessable password equivalents.

AppleID's can be reset by knowing your email address, date of birth and normally 2 security questions.

In 2008 Sarah Palin's Yahoo! Mail account was broken into simply by looking up the answers to the security questions.

Paypal's two-factor authentication, a hardware token in my case, has a screen to enter the security code but a link that says 'i dont have my token with me'. Clicking on that link prompts for the answers to two 'security questions'. Answer them correctly and you're in!

Gmail, at least as of two years ago, let you choose a new password after correctly answering the security question. I once tried to answer the security questions to all of my close friends' accounts. I then sent the ones the I succeeded on (and was presented with a choose your new password screen which I then closed) and email suggesting that they change their security questions to something more secure.

I typically take the classic step of choosing "What is my password?" as a custom security question.

Probably not a good idea, considering the answers to security questions are often not encrypted or hashed.

Why would that be the case? It just seems stupid to do so. A security answer is pretty much functionally identical to a password. Doesn't make sense not to hash it(there are no uses of the answer where you would need it in non-hashed form)

They're often used by support agents as a workaround for giving them your password (which the entire world has been diligently trained not to do, right?). They're also often case-insensitive and ignore punctuation, and while it's quite easy to handle that in a hashed scenario, they're usually implemented by programmers that don't get security.

Of course, the same apps with security questions are probably the ones not hashing your actual password in the first place.

Yeah it is stupid, probably because security answers are needed to trigger some system on the server side (not to decrypt anything) and if an attacker has access to the DB, probably can already trigger the process. But actually they are even more sensible to reuse than passwords, so they should be hashed.

I'm not sure about all security questions, but I have noticed many credit card support lines ask me for my mother's maiden name, and the answer I give is long and not easily spelled but they always confirm -- instantly -- "that's it" and and proceed.

Think about last names, as well... there's huge variety in length, spelling, etc. -- it's poor customer service to force the customer to spell it out letter by letter -- so it's necessarily just displayed there on their screen.

Yep, I always simply generate another random password and save it in my KeePass along with the actuall password, together with the question (custom or whatever was choosable).

I use it as password hint if I can (e.g. make it show the first character of my password, I'll remember it then). As answer I enter like 50 random characters which I don't write down or remember or anything, since I should simply know the password or use my recovery e-mail.

The problem is that most sites won't let you set your own question. More about my idea on security questions: http://lucb1e.com/!65

I make up additional weird randomness (but stuff which would be hilarious but not incredibly offensive to say to a CSR) and save it in my password manager for each account.

Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...

Simply brilliant. You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions.

Do you mind if I quote you (with link) on my blog?

Go ahead... hotmail by the way still let's you take over someones account by only knowing email address and answer to security question which is often maiden middle name, name of first pet, best childhood friend etc... you can find that information freely from facebook for an example. Or just ask :)

Forward all your "friends" one of those "50 Things You Didn't Know About Me: Fill In Your Answers and Forward!" question lists that includes the security questions you're targeting.

> You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions.

Google, too. I suggest you run through the recovery process yourself (on a dummy account, or your own) to see the kinds of questions asked. Questions like "when did you last access the account?" are easily answered; as is "name 5 regular contacts"; and so on. I could (but would not) perform the recovery process (and gain access to) acquaintances accounts, given how simple the questions are.

The key is just knowing "enough" in aggregate to pass their bar.

It's also how Kernell "hacked" Sarah Palin's email account: http://en.wikipedia.org/wiki/Sarah_Palin_email_hack

I could be wrong but I think you're admitting to a felony or multiple felonies.

Part of the problem is thinking that laws are an effective solution.

Depending on the jurisdiction, it's entirely possible that a statute of limitations makes this irrelevant (in a legal sense). Obviously you still don't want future employers etc. to find this post.

I use pwdhash for all my primary web passwords, but I have a secondary password that I use as my response to all security questions. I think this is a decent solution, but some services (I believe Apple is one example) requires multiple security questions and requires the responses to all be distinct.

A long time ago I was unable to answer the security question for my AOL account. The account had been hacked and used for mass spamming. AOL would not close the account, or help me change the password (or stop the spamming) until I answered the question.

"...but the account is being used for malicious purposes." - me

"Sorry, sir but until you tell me what you named your first dog I cannot stop it." - AOL

I don't worry too much about someone trying to know the name of my first pet (I'm pretty sure anyone who knows what my answer would be to this question is dead). I do worry that there are a bunch of other organizations that I have told that information. If someone hacks one of those they can get access to my other accounts.

One of the worst sites I saw demanded that I select my security question from a list. Sweet gosh, I have absolutely no idea which of your brain-addled security choices I selected.

This may not have helped your specific case, but I recently bought 1Password, and updated all my security questions with randomly generated 16 character string answers, and just put those strings in the "notes" section of a website. So when they do challenge me I can just copy/paste them in. It's been awesome!

I've used 1Password generated passwords for years. You're right, it is awesome, but only until you have to relay one of those generated strings to a support person over the phone:

"...left curly brace. No, it's like the parenthesis, but squiggly. Are you using a regular keyboard? Hold shift and type the left square bracket. The square one. It's to the right of the P..."

Nightmare.

I can't imagine the horror of having to recite any password to an actual human being. What kind of company asks you to tell them your password by phone?

"No, the backslash. The one that leans backwards, no, I mean, to the left. Above the Enter key." Surprise, the backslash is not above the Enter key on Canadian bilingual keyboards.

I assume the support person is asking the security question, but the user entered his mother's maiden name as -K$%3{Tm,fsj$k8L or something similar.

No surprise to learn that she was quite keen to marry and be rid of it.

    What kind of company asks you to tell them your password by phone?

I don't remember for sure. I think it was a utility company.

Heh, yeah luckily I haven't had to do that, but I have chosen some obscene answers to them, and then later had to recite, and spell them out to a horrified Indian call center worker.

I see why you had to mention that the call center worker was "Indian". If you hadn't, your entire statement wouldn't have made any sense. Right?

Well, the implied ethnicity of the poster is non-Indian, so in addition to the embarrassment of having to spell out obscene words, there's the cultural gap as well. The poster can't judge how offended the call center worker was, and probably feels like he's poorly representing his culture. I've had many similar experiences, especially since I've been living in Korea recently, and it's very uncomfortable not knowing exactly how big of a faux pas you committed.

Yes I'm non-Indian, and that was just a way to indirectly reference my culture and language gap with him.

Makes sense. Thanks to both of you for taking the time to clarify.

Indian culture is pretty uptight in certain ways, and knowing that would make me feel a lot more guilty about making them uncomfortable.

http://news.bbc.co.uk/2/hi/7871304.stm

Well he was, and that's part of the story. I wasn't passing judgement on him as a person, or stating that because of that one characteristic he was Evil.

Edit: see my response to shard. No offense intended, and I hope none was taken :)

I use LastPass, but also use generated passwords to answer security questions. For these questions, one can enable the options for only using alphanumeric, unambiguous characters.

It's a good point towards passphrases instead.

1Password gladly generates "pronounceable" passwords (e.g. "thax-lers-ponc-werv"). I usually think a bit about whether digits or symbols are required (some services and websites - Skype notably) don't like them.

A 20-char passphrase with spaces, dashes, or character-based (e.g. "S") word-boundary delimiter is often good enough to provide excellent (80+ bits) entropy.

Even better is to generate real words. I took a "1000 most common english words" list and reduced it manually to 256 that don't rhyme with other common words and now use that to generate pass-phrases. It's my best solution for English since phonetic spelling isn't a feature of English.

Or how about everybody that uses these fucking inane rules just do something sensible - like lock an account out if there are more than 5 failed logins in a row. Using a setup like that even "4321" is probably secure enough. Obviously use a secure hash on the backend as well.

OK, let's do that. How long do you lock it for? What if it's a common email address? How can the real owner unlock it?

That's the trouble... the "sensible" options aren't so sensible when you really sit down and think about how they can be dodged, broken or abused.

Imagine I'm trying to crack into your site, and you lock any account after 5 failed logins in a row.

If I have access to (or can guess) a few thousand usernames, I can try the 4 most common passwords on all of those with no problems. I'll probably get some hits, no?

Or heck, I can try the 5 most common passwords, and not only will I have a few hits, I'll also have plenty of time to dig around without any attention from you, because you'll be struggling with a massive customer service nightmare, as thousands of your customers find themselves all locked out the same morning.

The point being : you shouldn't transmit your password to anyone in any way possible ( especially on the phone ).

for more relevant info google "hunter2"

Agreed. Shame to see so many reputable companies not give a rat's ass about security when they seriously prompt for security questions like "Where was your honeymoon?" or "What was your first car?" -- I've even seen "Where did you graduate High School?"

My favorite thing is when the answer to the security question is allowed to be remembered by the browser, meaning anyone who gets my password can saunter up to any computer I've used in the past and bypass the stupid security question.

Yes, but security questions are designed to protect against untargeted phishing. There is little than can be done to automatically help protect against targeted spearphishing attacks against a particular person.

create a "secure note" in LastPass to store "exact" answer to security question(s)

Reply on news.ycombinator.com