Hacker News Reader

Comment by browningstreet | Hacker News Reader

A lot of financial things in the US are “secured” or anchored by SSN, that’s the only reason why. That and mother’s maiden name and first vacation and other security questions. It’d be less important with MFA now but SSN is also needed when opening new credit, so having it allows you to pretty easily fake someone else’s identity for credit. KYC hasn’t removed it from the equation.

View on HN

One mitigation is to make your mother's maiden name the output of:

    head -c 20 /dev/random | base64

And keep track of the result in your favorite password manager.

Fortunately, fewer and fewer orgs are using security questions, but there are still some important ones that only use that and no MFA.

The problem with that plan is social engineering attacks. CSRs are often careless and will accept 'a bunch of random letters and numbers' as the answer rather than validating each character.

Better to randomly select a long dictionary word or hypenate a few together. Equally unguessable but easily verified, so it won't be weakened during a phone conversation.

"Mother's maiden name" won't work for my kids - my wife kept her name and the kids' last name is hyphenated, so you just have to guess whose name we put first.

It's also probably increasing easy to look up.

We need a national (preferably RFID-ish) password system.

Reply on news.ycombinator.com