Hacker News Reader

Comment by lolinder | Hacker News Reader

It drives me absolutely crazy that the same bank website that times out my session after 5 minutes of inactivity insists that I set up recovery questions from a list that all amount to what is typically public information. I just save these as random values in extra fields in my password manager, but it's a ridiculous exercise for a website that thinks it's important enough to time out the session.

View on HN

> I just save these as random values in extra fields in my password manager

Unfortunately that opens you open to a social engineering attack, 9 times out of 10 if you call the helpdesk for a password reset and they ask you the questions and you answer "some random junk I don't remember" they'll reset it for you..

My solution to this attack is to generate random words (what 1Password calls a "memorable password") instead of something totally inscrutable. Most security question fields are long enough to accept 4 words (occasionally 5). I think it should be much harder to convince a customer support agent with "it's just 4 random words from the dictionary" vs "it's 32 random characters, do you really want me to go through it all?".

(I'm sure a determined enough attacker will eventually find an agent willing to accept the former excuse, but if it reaches that point, I think I've already lost this battle.)

I guess the better solution is to make the answers different for each site, and plausible (i.e. childhood street is an actual street name somewhere), but False. Then saving these in your password manager. Given there are typically a few questions in the mix, each answer not having a huge amount of entropy doesn't matter as much.

my bank offers phone banking.

Which involves you speaking a pin over an ordinary insecure phone call.

My phone bank now uses voice recognition. It used to be letters from a password.

    > ordinary insecure phone call

Is POTS or mobile phone voice calls considered insecure? I am surprised by this.

For diplomats and organised criminals, probably insecure. For the rest of us, it's fine unless you're being targeted by someone with state-level resourcing

emphasis on the word "speak". To me there is never any reason to speak your pin/password out loud.

Reply on news.ycombinator.com