Hacker News Reader

Comment by swang | Hacker News Reader

"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we currently know, this information alone is NOT enough for anyone to gain access to Battle.net accounts."

The part where it says, "answer to the personal security question" were accessed should be EXTREMELY ALARMING. This combined with an email addresses is usually enough to get your password reset on lots of sites. I believe this will reset your password on Google (assuming you're not using 2 factor).

View on HN

When storing data on my server I always treat secret questions and answers the same as passwords, because that is exactly what they are. What use is a strong password if a weak secret answer can unlock the account? I salt and hash the secret answers just as I would passwords themselves.

Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?

I've called before to recover an account and the tech support guy asked for the answer to my security question.

> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?

I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).

They can confirm identity with a one-way hash - the only reason I could think of not supporting this would be fuzzy matching.

Well, that would be thhe reason, I think...

Example:

For: "Who was your favorite high school teacher."

- Mr. Berners-Lee - Mr. Berners Lee - Tim Berners-Lee - Mr. Lee

Never mind if you had two different teachers who were great, and you switch them interchangeably depending on whether you're in an English mood or a Music mood

Of course, your answer should NEVER match the question. But that's beside the point.

"Whose was your favorite high school teacher?"

-Pecan pie.

The point still stands, though. There is way, way too much potential variation to hash that stuff.

I think the bigger point is that a ton of signups use this question. Whether you say 'Mr. Smith' or 'Pecan Pie' isn't going to save you if you use it for all of them.

Actually, you often get to pick your question. If they don't hash the answer, however, you're screwed. It seems doable to me: drop on non alphanumeric (or something), split on whitespace, trim, lowercase, put back together. It beats the hell out of putting in the "right," googleable, answer. Sarah Palin can attest to that.

Getting to pick your own question in my experience is rare.

We've already gone over the possible reasoning for not hashing the answer.

The only company I use that allows me to pick my security question is google. Apple doesn't, my bank definitely doesnt.

At appleid.apple.com I can pick from a list of 15 security questions or use a custom one.

Strange - I have only preset questions.

The only problem is that in 5 years you'd have no idea what you answered there. And that's exactly when you'd need it.

Yeah, unless you do it consistently everywhere, which again defeats the purpose.

Maybe you could do something like consistently answer the previous question from the dropdown?

Or use a tool like 1password to generate and store the 'answers'.

You need those answers exactly when you don't have the password, which means your 1password failed for some reason (otherwise you'd have the password from it). For me it usually happens with sites that generate their own passwords which I for some reason failed to enter into 1password some time ago (probably because I didn't use the site for a long time).

You could still do fuzzy matching with a one-way hash, you would just have to generate the fuzz beforehand. Create ten or twenty strings which you will also accept and hash and store them all.

> a two-way hash (that their support app reverses)

Isn't that just encryption?

I'm not a security expert, but yes. Hashing is, by definition, a one way process. If it is meant to be encrypted and decrypted it's, well, encryption...

Possibly. I've been on phone support with companies that require me to tell them answers to my security questions. Also, automatic security question checking would require support for soft matches like capitalization or punctuation. You could simplify the data before hashing (strip special chars and convert to lower case), or store multiple hashes to each variant.

I really wish a lot more work went in to security question penetration testing. It's relatively easy for a determined attacker to come up with the correct answers to these questions (or convince a human that they know the answers). The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication.

> The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication.

Isn't that how the Sarah Palin thing happened?

Yes. That's exactly the incident I was thinking of.

I think a good balance between usability and security is to normalize the answer (discard case, punctuation, etc) and then hash it.

My favorite security answer is "@#¤ß$ä#$&%^$" so please don't discard case or punctuation.

(Yes, I design these answers virtually impossible to brute-force even for myself.)

I too use a random and unique Secret Answer each time I am prompted for one. The Rackspace people, who require the account's SQ/SA before they push you through to the real support people, think I'm weird.

I just mash my keyboard for 10 seconds if I have to supply one.

But now I wonder if "A bunch of random characters" would be accepted as the answer.. >(

This is why you never use the actual answer to that question, but actually a separate password for those.

That wouldn't help. For example, let's assume your question was, "Who was your favorite teacher growing up?" and your answer was "fish123jellybean456". If that answer is stored in plaintext (no encryption) in a database that's compromised, then it won't matter that it's not the "real" answer. Attackers will see it, and then use it to answer your security questions on other sites. The only way to protect against this is to ensure you use different answers on different sites.

Using a password instead of the correct answer to the question can be helpful, but in a totally different way. Specifically, it eliminates the risk that someone can guess (or research) the answer to your security questions.

Presumably you would use a different answer on every site.

For most people savy enough to use an arbitrary answer, it is because you can use a different one each time (with the very few exceptions where you may not be able, e.g. banks).

Offline portable password managers like Keepass/Password Safe/etc. are immense help for these non-bank services.

I believe Blizzard makes you supply a scanned copy of your state issued identification in order to get a password reset.

This is only to remove an authenticator. I just changed my password and it didn't even send a confirmation email to confirm the change - it just changed it and sent me a notification email.

Reset password, not change password.

This is true. Blizzard is unbelievably strict about their account reclamation process. Several years ago I tried to access an account that had been in my ex-wife's name. When I told them that the ex-wife and I weren't in contact, they asked for a copy of the divorce decree, or separation paperwork, or whatever. Seriously.

Of course this was in the 2008 timeframe so maybe things have changed/loosened up since then.

No, that is only if you fail the hint question. If you don't know the hint question, they revert to scanned ID. Tried it a few weeks ago.

This sort of thing kind of bothers me. Is Blizzard in the business of verifying state-issued identification? What prevents me from photoshopping my target's name on top of my own ID?

I'm not sure how ID cards work across the globe but usually they have some code on them that is supposed to be unique.

So you would have to scan your name _and_ the other data, which you would not trivially know.

(Yes, I understand that there are ways to get those too)

> "(Yes, I understand that there are ways to get those too)"

And at the point that someone can get a passable fake ID in your name, you have far bigger problems than their social-hacking an online service account.

Secret questions are extreme bad security practice. They're essentially a way to trade off a large amount of user security for reduced customer support costs. It's the same as telling your users to pick a weak password (one that's very likely to be in a dictionary) and then give the attacker a hint what it is. On top of that, many providers (apparently Blizzard included) do not treat the answer to the security question as carefully as a password, e.g., they store it in plain text.

Agreed. I really dislike the "security question" feature a lot of sites force you to enter. In my opinion they make my account much less secure than it would be without this feature. There are plenty of people around who know my email address and have the means to find out my mother's maiden name, or what car I first had or whatever ridiculous information I'm forced to provide to "secure" my account.

These shouldn't be genuine answers. Put your grandmothers maiden name instead of your mothers, your first car could be Apollo 11.

Wow, my secret question is "Who was your first employer?" How is the answer to that even a secret?! Did I pick that or did they?

Reset your password via your original email...

Reply on news.ycombinator.com