Hacker News Reader

Comment by shawndumas | Hacker News Reader

I am confused; did the hacker guess the security questions or obviate them?

If the former it's not Apple's fault. If the latter; that's inexcusable.

Actually, it appears to me that almost 100% of “security questions” used during support phone calls are completely insecure.

Usually they'll ask a few (2~3 is normal) questions like your full name, date of birth, address with zipcode, email address, etc. Notice the problem of these? All of them, I mean, ALL, are PUBLIC INFORMATION THAT ANYONE KNOWS SOMETHING ABOUT YOU WILL HAVE.

This is almost as silly as credit cards, where you are supposed to give the card number, card holder's name (not required most of the time), expire date, and the 3-digit PIN. Anyone who touches your card will have that information, once and forever. Yes, ANYONE, that includes your grocery store cashiers, your favorite bar tenders, your mobile phone billing representatives, etc. The list could go on very, very long.

And I'm totally amazed that both systems persist as a fallback plan in this digital world with countless attacking vectors.

As I've said elsewhere: "Keep in mind though; you can answer anything you want. Use a 1password generated string for each and store the answers redundantly. That's what I did."

Based on my experience, that's not how it works at all in practice. They will ask these info about your real identity as recorded in their CRM systems. I doubt you can list your name as BLAH BLAH BLAH there and still receive your package delivered correctly.

If a human is in the loop and you need to call in to verify - this could get quite difficult unless you use the "pronounceable" option in password generation.

The thing to remember here is that where the liability lies matters. The banks effectively take on all the liability for financial losses due to credit card fraud & they're free to setup their systems to constrain losses to a level that they're happy with. Yes, arguably not all the losses fall on the banks, particularly the hassle and time of recovering from a particular instance of fraud but the majority of them probably do and that's what matters because the interests of those who bear the losses and those who run the system are aligned.

The trouble with cloud systems is that all the losses fall on the end user who has no influence over the security systems put in place to protect their data. (Except with Google where you can at least choose to use 2-factor authentication.)

Banks are experts at pushing financial liability onto others. Much of the time, credit card companies inform the merchant that they aren't going to pay for a transaction that they have deemed fraudulent. The merchant can chase the fraud themselves or eat the loss.

The fact that 'identity theft' is a commonly used name for bank fraud is another example. When some bank opens an account for person Y, there should be zero consequences for person X (regardless of any fraud committed by Y), but the banking system isn't quite set up that way.

If the Apple-chosen security questions are reasonably guessable, that's still Apple's fault.

Here is the list; You tell me.

Keep in mind though; you can answer anything you want. Use a 1password generated string for each and store the answers redundantly. That's what I did.

---------------------------------

What was the first car you owned?

Who was your first teacher?

What was the first album you owned?

Where was your first job?

In which city were you first kissed?

---

Which of the cars you’ve owned has been your favorite?

Who was your favourite teacher?

What was the first concert you attended?

Where was your favourite job?

Who was your best childhood friend?

---

Which of the cars you’ve owned has been your least favorite?

Who was your least favourite teacher?

Where was your least favourite job?

In which city did your mother and father meet?

Where were you on January 1, 2000?

That's why I always give a ten character random string as answers to those questions.

I use the 1password pronounceable strings. Still plenty random, but you can say it over the phone to a customer service person if you ever do need.

Great idea: Updating my questions now...

I can barely answer half of those for myself and out of those that I can answer I'm either not sure I'd answer the same thing a few years later or it will probably be something a lot of people know.

Those questions are terrible.

Answering with a random string is the only sensible solution. But it is just as mindbogglingly bad. Because then you could just as well write down the password - and bam, you'd never lose it (well, if you did lose it you would have lost the answers to these questions as well so either way you are screwed).

Just keep in mind that the ACTUAL answer to the security questions doesnt matter, just whatever you type into the box the first time.

What was your first car? "spaceship" is perfectly acceptable response, and its not discoverable by public means.

it does however mean you need to know what you would have typed in for each of the questions.

For every single of these questions, my wife, mother and sister would know the answer as well. Ergo, they are not acceptable as a "secret" that can be used to grant access to my account; Apple should provide reasonable privacy also from my in-laws. The whole concept of "security questions" is stupid and useless, and shouldn't be used ever and anywhere.

According to the guy's comments on Twitter, the hacker didn't have to answer the security questions.

Reply on news.ycombinator.com