[jonathantm]

What is your mother's maiden name?

T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl

[moo360]

Of the Greenwich T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl's ?

[rezashirazian]

I laughed too hard at this.

[djsumdog]

I hate it when I'm asked this in person at banks and shit.

"Your mother's maiden name has four numbers in it?"

"It's a password. You should never use real answers for security questions."

[Klathmon]

Which only works until you call in asking for a password reset and when they ask you the question you just say "I just hit the keyboard a bunch".

[mikestew]

No, I pull up the answer out of 1Password and read it off to them.

[Forlien]

I thought Klathmon was pointing out say that they an attacker could say that they just mashed on the keyboard and that would be good enough for the fallible human on the other end of the phone.

Anecdotally, I had a time where I couldn't remember may answer to a secret question except that it was a type of food. I called in and the human on the other end let me reset my password with just that explanation. Take that for what you will, but it seems like if someone knows you use passwords that are random strings, they can use that to break in.

[Klathmon]

Sorry, I meant to imply that the support person will hear the explanation and let you reset the password without the actual answer.

[mikestew]

Fair enough, as I believe I've had that happen. Random string for one of my financial institutions, needed to reset something. Pull up 1PWD, with random string at the ready and...they asked me questions that could have been pulled from a copy of my credit report. I didn't ask, so I'm not entirely sure, but I wonder if they didn't look at the answer, said to themselves "fuck that" and went with Option #2.

[roywiggins]

Diceware is a decent option for security questions. They work fine over the phone.

[astrodust]

"Charlie capital-echo lima peru capital-october..."

[weinzierl]

Wait until they introduce a real name policy...

[ocdtrekkie]

But when the security question answers are leaked in plain text, they can still use it to get into your account.

[WillPostForFood]

It's a good strategy, but a pain when you have to tell them over the phone.