[sersi]

And this is also why I almost never give my real birth date when registering on websites (except on financial websites or websites where I'm legally obligated to) and I never ever give real answers to the security question..

My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager

Security questions weakens the security of an account, they are easily found information that people can just guess.

[JupiterMoon]

> My typical answer for a security question is something like "39arsrc uyrsrsaulsr8832r" and that's saved in a password manager

The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account..

[JumpCrisscross]

> The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account

I used to do this and then lost my password file. Fast forward to a call with AT&T. I told them I forgot my secret answers. They offered that it was "a super weird answer," which let me use the "mashed keyboard" line and got in. TL; DR I think this system is less safe than just making up cars, cities, et cetera.

[ncallaway]

Yea, I always use a handful of random words. That way, it's something pronouncable over the phone.

Still, I expect "oh, it's a random word not related to the question" would clear phone screen human layer of verification a good percentage of the time.

[thaumasiotes]

I can confirm that "I'm not going to be able to tell you the secret answer" was accepted by Blizzard when they locked my account and made me apply to have it unlocked.

I'm still bitter about that. I put garbage in the answer to the secret question because I planned not to forget my password. I didn't forget my password, but Blizzard nevertheless locked me out of my account, for the crime of using a payment card that was listed on my account, but wasn't listed as my "preferred" payment option.

[pishpash]

Yes, you should just make up a fake personal profile, and base your answers on that. True answers and human-bypassable answers are all bad, whereas fake answers open you up to a world full of entropy.

[ohazi]

correct horse battery staple?

[alphast0rm]

This is a reference to the XKCD comic, Password Strength [1].

[1] https://xkcd.com/936/

[isostatic]

And for those who think the reference is so well known it doesn't need citing: https://xkcd.com/1053/

[Chris2048]

Quite Frankly - bad math. You judge people based on how old they are..

[auxbuss]

A fun place for names:

http://www.fantasynamegenerators.com/

[tony101]

One solution would be to randomly generate security answers with human readable words. Diceware does this. You can use a dice, or you can use an open source tool like this one:

https://www.rempe.us/diceware/#eff

https://en.wikipedia.org/wiki/Diceware

[gecko]

It's also built into 1Password. And before that, I just used what I think was literally a one- or two-line Perl script that just grabbed four words from /var/dict. Why yes, my mother's maiden name was indeed pathetic xylophone tootsie wasp, how did you know?

[developer2]

The entire point of security questions is that their answers are supposed to be things that are permanently stored in your memory, that you are physically incapable of forgetting because they are so ingrained. If you store these in a password manager, it is possible to lose them - and that is unacceptable.

These are supposed to be the very last line of defense for security, including if lose your password manager. As an exaggerated analogy, imagine that being unable to answer these questions meant your house, car, and life savings are taken from you. That is how important these answers are, except you're "only" losing one online account at a time.

Of course, it's terrible to use personal information that can be known to 3rd parties. It's also bad to reuse the same answers across multiple companies, as a compromise at one means you're at risk everywhere. The reason behind why security questions exist is a good one, but they don't offer enough security when used as intended (memorable, non-random data). The problem is there is currently no better alternative, short of requiring you to tie your legal identity to every account, and having to show up in person with photo ID to regain control of an account you've lost access to.

Anything relying on tech (like a password manager) is a bad idea for the general public. The average person does not have multiple off-site backups to guarantee that the information is physically impossible to lose.

[marcosdumay]

Hum... I'd say that the entire point of security question is that incompetent people can appease non-technical bosses by claiming that they follow best practices.

Where they stand at the security line is irrelevant, because their mere existence on a place is already a symptom of a deep level of incompetence and an almost sure prediction of a compromised system. Besides, security is usually chain-like (compromise one node and it's broken), not army-like (compromise one node and you'll have to fight the next).

Besides, most people do not have a favorite color, do not remember the name of their 3rd grade teacher, and have severe doubts about what counts as their "first" pet. Yes, they are intended into solving a real problem, but nothing about them survives any amount of questioning.

[andrewem]

The problem is that anything which you remember that well is likely to be discoverable by other people. For instance, if someone's mother is dead there's a good chance that her obituary will be online and list the names of her children and her maiden name. Likewise, you could find the name of a person's elementary school via looking at their posts on Facebook in many cases - or if not their posts, then their siblings or their friends. So these kinds of questions are hardly a great proof of identity if it can be found online with a bit of searching.

[wpietri]

That might have been the theory of security questions early on. But by now I'm sure I've filled out security questions dozens of times. Whatever the intent, from my perspective as a user, they're in the "speed bump" category of security.

For things like house, car, and life savings, I'm perfectly glad to go somewhere with physical ID. Heck, I'd love to see police stations offering this as a municipal service. Lying via internet form is pretty easy. Walking into a building with 100 cops bearing fake ID is a whole different level.

[pktgen]

> For things like house, car, and life savings, I'm perfectly glad to go somewhere with physical ID. Heck, I'd love to see police stations offering this as a municipal service. Lying via internet form is pretty easy. Walking into a building with 100 cops bearing fake ID is a whole different level.

This is a great idea. Not only can the police verify that a given photo ID matches the person in front of them, they can also verify that the ID is valid and unaltered by verifying that the details on the ID match the details in the DMV's database, eliminating fake IDs from being an issue. This wouldn't be 100% perfect -- maybe a really determined ID thief could get the DMV to issue them an ID in someone else's name -- but it would dramatically increase the risk and makes ID theft much harder to scale.

A federal effort to standardize an identity verification service across federal and local offices nationwide would be helpful. The service should be available to any entity (not only banks or financial entities) who wishes to verify the identity of a counterparty. The process and fee should be standardized nationwide, with the fee being break-even and paid by the entity requesting the verification.

Post offices are a good candidate to offer such a service, but would need some work to set up (unlike police agencies, I presume post offices don't have access to DMV databases).

[Fnoord]

> The entire point of security questions is that their answers are supposed to be things that are permanently stored in your memory, that you are physically incapable of forgetting because they are so ingrained. If you store these in a password manager, it is possible to lose them - and that is unacceptable.

With a password manager such as Lastpass or 1Password you only need one very strong password you as human can remember. The passwords it manages don't need to be human-rememberable. They can have as high entropy as allowed.

> Anything relying on tech (like a password manager) is a bad idea for the general public. The average person does not have multiple off-site backups to guarantee that the information is physically impossible to lose.

2FA of the strong password plus physical OTP (like YubiKey) with one backup key is more than suffice. Sure, its not 3 letter agency proof. They can easily break in your house and steal your backup key temporarily, whilst recording you typing in your password, or catching you on the go. But against most criminals (a much more common vector for the general public) this is going to work just fine.

[kelnos]

> These are supposed to be the very last line of defense for security, including if lose your password manager.

Security questions aren't for security, they're against it. They're a tradeoff between security and usability, in the direction of usability. Assuming you answer security questions truthfully, they weaken the security of your account. It's like having multi-factor authentication, but instead of requiring all the factors, they just require any one of them. That's not necessarily a bad thing, as long as it doesn't weaken the security so much that it's easy to break.

> Of course, it's terrible to use personal information that can be known to 3rd parties. It's also bad to reuse the same answers across multiple companies, as a compromise at one means you're at risk everywhere.

And here's the problem. Many/most sites that use security questions have a dropdown list of acceptable questions and don't let you enter your own. Often the only thing you can do to avoid making your account easily compromised is to make up answers to some of the questions.

The downside, is, of course, the usual downside with security tradeoffs that favor the security side of the equation: you may be completely unable to access your account again if you screw this up. And that's also not necessarily a bad thing, if you believe compromise to be a really bad outcome. I think it might be ok to do this for, say, a bank or brokerage account. If you manage to fully and truly lock yourself out online, likely you'll still be able to prove who you are and gain access through some means like visiting a physical branch and showing them your ID. A hassle, to be sure, but if it means that much to you, it might be worth it.

In the end, social engineering is still the biggest problem: other posters in this thread have claimed that they've gotten past the security questions by saying things like "oh, I just mashed the keyboard, that's why my answer is gibberish", or something like that. So there's no way to win, unless perhaps you invent plausible (but incorrect) answers to the questions. "Mother's maiden name? Well, it's actually Jones but I'm going to put in Smith." I imagine a talented social engineer might still be able to get past that, but at some point you just have to acknowledge you've done the best you can.

[Dylan16807]

> The entire point of security questions is that their answers are supposed to be things that are permanently stored in your memory

And it's a shame to lose that feature, but they compromise your security so terribly that you're far better off not using them.

> it is possible to lose them - and that is unacceptable

Ten steps forward, two steps back. I find that acceptable.

[PretzelFisch]

why not just offer a snail mail reset?

[ddevault]

You don't have to say "oh I just mash the keyboard for those", you can say "it's weird, bear with me" and read it out from your password manager.

[ajmurmann]

I do exactly this. About 4-5 characters in the support person interrupts me with "yeah, whatever".

The entire security question situation makes me incredibly pessimistic that we will ever get good security. The idea of security questions is so mind numbingly stupid to me yet it's widely used. One would have thought that after the Sarah Palin hack years ago everyone would have realised that but it seems like nobody did. The support agent didn't see my security question and go "oh that's clever". That's despite him being a person who deals with these all day they should realise the overwhelming stupidity. In a sane world companies who tell their users to use special characters etc. in their passwords and rotate them but then encourage them to mess it all up by storing information from their Facebook page ad a replacement for the password should have to pay massive fines. Yet hardly anybody is even seeing a problem with this.

This situation to me is so demotivating because it makes me think that whatever security mechanism we come up with well meaning people will undermine it.

[smelendez]

Four to five characters is probably enough for their threat model though?

The only way I can think of that somebody could steal only the first few characters of your security answer is by looking over your shoulder at a very unfortunate time. That seems unlikely, and most of the questions they use are predictable from the first few characters when answered genuinely anyway (surnames, car names, streets and towns).

[maxerickson]

The quote is an attacker attempting to bypass the check.

[wyager]

It's not about what you say, it's about what an attacker can get away with saying. And they can almost certainly get away with "I just mash the keyboard."

[Sir_Cmpwn]

Ah, I see what you mean. Perhaps instead of grabbing a handful of characters from /dev/urandom, you generate a passphrase (a few random dictionary words)?

[jeffmould]

Been doing this for several years and prefer this method. I also try to reduce the number of times I use a particular security question. However, I don't think the problem comes from what questions you use or what answers you provide. It becomes like others have pointed out, a problem of what a hacker can get away with answering when asked by a phone representative. Although, I do think this approach provides a little more security than just answering the "what city were you born in" question with the correct answer on every site.

[np_tedious]

Sounds like a "correct battery horse staple" would fit the bill

[chiph]

Or use a memorable phrase from literature.

> This was not the last encounter between Bobby Shaftoe and Goto Dengo

[oh_sigh]

How would the attacker know that you mashed the keyboard when answering 'What high school did you go to?' ?

[brewdad]

Most likely from a "helpful" CS agent offering up the hint above. "It's really weird" or "I've never seen that one before" or just an odd chuckle. Anything an attacker could use to gain an advantage will be used to compromise you eventually.

[dllthomas]

Or because you posted about it on HN...

[macintux]

How hard do you think it is to get a bored call center employee to give you enough of a hint to know that it’s random characters?

[musage]

But the attacker kind of has to know the answer is gibberish from the bat, otherwise they'd either guess or pretend to not remember a real answer, which is noticeably different from saying something like "oh, that's 30 random characters but I don't have the note with me right now".

[cortesoft]

Here is how it would go... attacker gives a real answer, support says no that isn't it. Attacker goes, "oh, sometimes I give fake answers for the question... is it a really long string of characters?"

Or they could go through a few things like that, always giving the excuse that they give false answers until they stumble on the right one.

[tonyedgecombe]

But we already know @sersi just mashes the keyboard for those questions :)

[sersi]

Sure, but I doubt it would be easy to find my identity from my hn account name.

[evincarofautumn]

One trick is to use pronounceable passwords as answers to security questions, like a sequence of words (“Mother’s maiden name?” “correct horse battery staple”) or arbitrary syllables that make it sound as if you’re having a mini-stroke (“Where were you born?” “prisencolinensinainciusol, oll raigth”).

[stordoff]

I try to leave them unset where I can (probably doesn't help over the phone; I'm thinking more of online accounts), such as on eBay which keeps prompting me to set security questions but going back to the homepage lets me avoid doing so.

For sites that force you to set them (and where I care - otherwise they just get random nonsense), and for my bank, I have a set of plausible but false answers I use. Not bulletproof of course, but definitely not googleable and avoids the "I just set it to something random" attack.

[LoSboccacc]

that places the liability on the phone rep, while guessing an easy answer places it on you, so still a better choice

[l0b0]

Just generate a pronounceable word, for example using KeePass*.

[djsumdog]

"Your mother's maiden name has numbers in it?" (bank teller, DMV person, etc.)

"You .. give real answers for your security questions? Seriously?"

I do the same thing, real birthday if it's financial or employee related, but for everything else, I'm a few years older on another date. I often pick a security question that I don't have a real legit answer to as well.

[raverbashing]

Yes, I try to make the fake answer sound legitimate though

City you were born? Just pick any (random/unrelated) city instead of 2DXSDGREDV@#!

It's easier if you have to go through a person (which is usually forced to go through a script) also easier on the phone

[wila]

Not just easier, but actually more safe. The person on the phone isn't usually aware about your security "paranoia" and is being evaluated on how much customers he/she has been able to help.

As such most helpdesk employees will accept the answer "Oh I forgot, I do remember I put some random characters in there"... and your random password end up not helping you after all.

[ubernostrum]

As noted in another comment, the attack on this of "oh I forgot, it's random characters" requires the attacker to know you do this. So if you do this, don't go disclosing it on public websites.

[always_good]

>requires the attacker to know you do this

Nah, "well, it kinda looks like random characters" is information a support rep will give you.

Welcome to social engineering and info escalation.

[ubernostrum]

If the support rep is just giving away enough info to figure this out, there is nothing you can do to protect yourself against the company's policies.

[whiddershins]

As another commenter mentioned, a help desk rep once gave the clue "it's really weird" over the phone, which would easily indicate to an attack to try the mash the keyboard line.

The random character thing isn't great for this use, it seems, as a result.

[ubernostrum]

If support reps give enough information away over the phone to let someone guess a security question, there is nothing you can do to protect yourself from them.

[dredmorbius]

The search space for city names is tragically finite.

There are ~35,000 cities and towns in the U.S., but if you start weighting those by populating (and birthing hospitals and centres), you're going to reduce that count considerably.

https://www.reference.com/geography/many-cities-united-state...

[llukas]

Why pick name of U.S. city or more general city in country you live/are related to?

There are a lot of lovely and easy to remember names in other countries ;)

[raverbashing]

Yes but if a system allows you to bruteforce this you probably have bigger problems

[dredmorbius]

The overall risk runs a few different ways. One is that you yourself will bee at risk, another is that there will be a high number of compromises.

There are about 300 in the U.S. of over 100k population (corollary: the other 34,700 locations have fewer than 100k people each, or are at most 10% of the population). A 1/300 chance of cracking a security question on any given transaction is pretty good odds. Particularly if the crack is then reusable.

Another 10% of the U.S. population (roughly) lives in the 10 largest cities alone. That's a 1% likely success rate based on just ten values.

The point being that "legitimate sounding but fabricated" may still not be a particularly good option.

[apcherry]

I don't even try to make it sound legitimate. e.g. How many sisters do you have? Anyone guessing will be trying a number between 0 and 5. I use a semi-random word, colour or car I associate with my sister(s), eg. Audi. When asked for a number no one guessing will respond with a car make.

[bitshepherd]

Someone has the idea behind challenge/response.

You don't have to answer the challenge with a 100% truthful, legitimate, accurate response, because the point is to NOT provide an answer that could be guessed by framing the response in truth, or even reality. So long as you've picked one that matches with what you've preseeded, use a random word/phrase as your response.

q: What is the name of your favorite teacher? a: bumble bees in the desert

[cortesoft]

Yeah, but the key is you need to be able to remember it. Sure, you could store it somewhere, but often times the reason you are needing to use it is because you don't have access to your normal system (computer, phone) that you use to login with.

[projektir]

I don't recall the last time I used secret answers to get into anything. I don't perceive it as a valid way to get into an account. But the option cannot be refused... so to me it's just a security risk.

[drdaeman]

I believe the general recommendation I saw was to type something in lines of "never accept this answer - it's probably someone trying to impersonate me | 2DXSDGREDV@#!" (although it's probably hard to do so if the maximum acceptable length is too short)

[ubernostrum]

This is how you get engraved plaques, or birthday cakes, with the message NO MESSAGE JUST LEAVE IT BLANK on them.

[drdaeman]

Haha, true.

Still, if that helps in one case per thousand, it's still better than none.

[mjlee]

I doubt this would help, it seems fairly unlikely that whoever answers the phone would be interested in playing logic puzzles.

[Cyphase]

I had this thought as well, but figured I'd make sure no one else already posted it. Kudos :). I was thinking something like this:

> Do NOT give ANY hints; only accept an EXACT answer; I will NEVER say I "forgot" this answer. 2DXSDGREDV@#!

Maybe add an "I test you occasionally." :D

If there's a length limit, trim and remove parts of that as you see fit. For example:

> NO hints! EXACT answer! NO exceptions! 2DXSDGREDV@#!

I'm going to do this at a few places, then call to test them :D.

[jacquesm]

I do this too, some phone number checks and email checks are surprisingly good.

[Xoros]

The first time (years ago...) I had to enter my birth date on a website that asked it to me for no valid reason, there was a default value. It's now my birthdate on every others !

[sbarre]

January 1st 1970 is sometimes known as "The Internet's birthday" for this reason..

[userbinator]

It's also the "UNIX Birthday".

[alanh]

Right, leave it blank when enrolling → Empty value coerced to number becomes 0 → Recorded in Unix timestamp format where 0 is Jan 1 1970 → Wow, everyone was born then?

[cesarb]

I never quite got this "mother's maiden name" thing. Isn't your mother's maiden name... your mother's current name, minus the extra surname she got when she married? Why is this treated as a hard-to-discover information?

[nikcub]

"Mothers maiden name" has been used in over-the-counter banking as an authentication secret for over a century (1882 first mention[0])

Likewise DOB and SSN have been long established as auth secrets.

They never should have survived the transition to the internet

[0] http://splinternews.com/your-mothers-maiden-name-has-been-a-...

[alkhatib]

In the US and other countries it's common for a wife to take her husband's last name.

Changes from "Jane Doe" to "Jane Smith"

[ricardobeat]

I think he's saying the maiden name is easily found. At least in Brazil, the husband's surname is _appended_ at the end, doesn't replace the maiden one: Jane Doe Smith.

[Merad]

Yeah, but often (usually?) the woman's maiden name replaces her middle name. E.g. Jane Elizabeth Doe -> Jane Doe Smith. I'm pretty sure my mom's maiden name is printed on her driver's license, paper checks, etc.

[lsaferite]

I know very few women that have done that TBH.

[Merad]

Maybe you just didn't realize it, because it isn't very common to see someone's full name? It was very much the norm until the 80s-90s, and even today I think the majority of women still go that route. I just spent a couple minutes searching Facebook to sanity check myself, and so far all of the women I'm friends with who are under 30 and married have done it.

[cortesoft]

That is not super common in the US.

[sandov]

In South-America and other countries it's common for a wife to keep the name she was assigned at birth for ever.

[ams6110]

It also is from an era when you would assume that a person's mother was in fact married. Less likely today.

[cortesoft]

Or for all the women in my family... their maiden name is their current name, because none of them change their name when they get married.

[Spivak]

I think the best bet is to provide an actual name in that field, just not the real one. Grab a list of the surnames and pick one at random. Bonus if you hyphenate two.

[mrhappyunhappy]

Doesn't matter if you give your real bday or not. I could easily google you, email one of your coworkers and ask for your birthday for a secret gift. Voila.

[mrhappyunhappy]

Ignore my last comment. I didn't follow your logic of putting a fake birthday into the site haha. Doh!

[baby]

When I was in high school, SWIM was stealing everybody's MSN's accounts. The technique got out, it was through these "security questions", then SWIM got his MSN stolen. Then people would recreate MSN accounts and get it stolen again. It became a funny war until some dude started asking for money to other people's contacts (via allopass, these things where you could just call a number to get charged and obtain some token).

Good times. Except some of my friends actually sent out some money. I'm pretty sure I know who did it.

Since then I enter garbage in these security questions. Better lose my account than that.

[alanh]

i had to look it up: SWIM = Someone Who Isn’t Me

[pfultz2]

You can't do that with United Airlines. The answers have to be picked from a drop-down of answers.

[justboxing]

>

I didn't believe you when I read this, but you are right. => https://krebsonsecurity.com/wp-content/uploads/2016/08/unite...

and..

> Yes, you read that right: The answers are pre-selected as well as the questions. For example, to the question “During what month did you first meet your spouse or significant other,” users may select only from one of…you guessed it — 12 answers (January through December).

> The list of answers to another security question, “What’s your favorite pizza topping,” had me momentarily thinking I using a pull down menu at Dominos.com — waffling between “pepperoni” and “mashed potato.”

Wow.

Source: United Airlines Sets Minimum Bar on Security => https://krebsonsecurity.com/2016/08/united-airlines-sets-min...

Video => https://www.youtube.com/watch?v=vmrdLAp7wSw

[alanh]

12 possible answers… little better than a 1-digit PIN!

[pokemongoaway]

I ran into an issue with this a few times... What was the fake birthday I entered?!

[trentmb]

Keypass has a random phrase generator plugin- it's what I use for security question answers.

[remarkEon]

Often for security questions like "what was the name of your grade school" or "in what city was your father born" I'll give intentionally wrong answers for the exact reasons you outlined.

[ape4]

My bank's terms of service bans recording passwords - ie managers.

[zaneyard]

How are they supposed to know you use one?

[diggan]

Not that they can really know, but most I've seen is that they disable pasting anything into the website, effectively making banking super slow for us with password managers and long passwords.

Fortunately, my bank doesn't disable pasting (Banc Sabadell in Spain). Instead the password is restricted to maximum 6 numbers for login. Yay banks!

[pwg]

In Firefox, at least, there is an about:config option to turn off the ability of webpages to disable paste. Flip that setting and managers work again on those pages.

[mighty_atomic_c]

6 characters? Let me guess, were there restrictions on character space and case?

One place I had an account has a password input that restricts all of those, so it's like an 8-10 character string of all capital letters. I don't understand it at all.

[pwg]

This is often an externally visible code smell that implies plaintext storage of passwords in a char(10) (or whatever the max length is) db column.

[diggan]

You read wrong, not 6 characters but 6 numbers. So no spaces or casing.

[cortesoft]

Yeah, I just disable their disablement. Super annoying.

[ape4]

Their site was broken one day. I could not login. I told support that I had not forgotten the password since I was using a manager. Then they told me about the terms. Ooops. Luckily they didn't ban me or anything.

[daxelrod]

Wow. What bank?

[samstave]

For security questions for sites I dont care about, I pick the subjedt of the question and use that:

"What city were you born in" == "city"

"what was the name of your first pet?" == "pet"

etc.

[justherefortart]

I use profane language since in my opinion the answer should still be hashed if I'm verifying it through the website.

Mom's maiden name: InfectedPussyPimple

How she got dad, I'll never know!

[andyjohnson0]

I use my real birth date when dealing with my bank or government departments. Everyone else gets the same fictitious but approximately correct date.