Hacker News Reader

Comment by nkrisc | Hacker News Reader

And here I am with all answers to my security questions as random strings of letters and numbers stored alongside my password in my password manager. I hope I don’t have to give someone that answer over the phone.

View on HN

I probably raised a fair bit of suspicion last week when I told the Wells Fargo rep handling a declined CC transaction that I had to look up my mother’s maiden name in my password manager.

At this point anyone handling passwords must have encountered enough of us to know that some family names need to be looked up in a password manager, and it isn’t that suspicious. Isn’t that right, my cousin? I can never remember how to spell grandma 38!;&,90-@3!;8,’s name.

I don't remember where now, but I have run into sites that disallow numbers and non-alpha characters in the "secret" question answers. They were actively trying to thwart people from entering random gibberish there. Of course that's silly, but so is thinking that a person's maiden name is some kind of secret, or that people will be able to reliably remember things like "the title of their favorite book."

My uncle is called Robert'); DROP TABLE Students;--

Duhangit Bobby

My only fear of doing this is that someone could call in and say "oh sorry, I just typed in a bunch of random numbers and letters" and the rep will go "haha, don't we all!" and let them reset the password.

If that happens then I don’t think my mother’s maiden name was going to protect me either.

Yeah, it is pretty awkward.

My forst car, sure: Capital-double-you, dollar sign, eff, nine, you, bee, gee, capital kay...

Reply on news.ycombinator.com