Namecheap live chat social engineering leads to loss of 2 VPS

Re:Namecheap live chat social engineering leads to loss of 2... by philsnow on Tuesday April 12, 2016 @12:31PM (#11480994)

For every site that does this, I have a blob of text in my password manager where I write down

Q: what was your childhood best friend's last name? A: pathway-titian-slowly-quiver-kodiak-hue

etc., even for fact-based things like "what city were you born in?" or "what street did you live on in 1995?".

[ Parent | on HN ]

Re:Namecheap live chat social engineering leads to loss of 2... by ceejayoz on Tuesday April 12, 2016 @01:05PM (#11481325)

Ah, but the anti-pattern folks have a way around that.

Drop-downs for answers. Just got this on United.com:

http://imgur.com/84l0CdU

[ Parent | on HN ]

Re:Namecheap live chat social engineering leads to loss of 2... by pyre on Tuesday April 12, 2016 @01:51PM (#11481842)

I think that the drop-downs are trying to prevent people from mistyping things and locking themselves out because "Accordien" doesn't match "accordion".

[ Parent | on HN ]

Re:Namecheap live chat social engineering leads to loss of 2... by ashitlerferad on Tuesday April 12, 2016 @01:46PM (#11481802)

How about 5 random questions, 5 random answers and record all of these in your password manager?

[ Parent | on HN ]

Re:Namecheap live chat social engineering leads to loss of 2... by kbenson on Tuesday April 12, 2016 @06:17PM (#11484066)

If you have a password manager that successfully tracks the questions, then there's no reason to need to recover the password, as you'll just track the password in the same system.

The catch-22 of these systems is that recovery questions need to be obvious, memorable and unchanging enough to the user that they are useful for recovery, while also being hard for a third party to guess/research. I feel like for the most part those are more often than not mutually exclusive.

[ Parent | on HN ]