Defending Against Hackers Took a Back Seat at Yahoo, Insiders Say

Re:Defending Against Hackers Took a Back Seat at Yahoo, Insi... by freehunter on Wednesday September 28, 2016 @01:37PM (#12599618)

Right? Like "what is your favorite food"... what do you mean what's my favorite food? What am I, five years old? Who the hell has a favorite food? I like pizza. I like wings. I like burgers. I like bbq ribs. Who has a single favorite food? "What street did you grow up on" like many people, we moved quite a few times when I was a kid. "What was your favorite vacation/What was your favorite concert/What is your favorite movie" change way too often for any long term kind of thing.

"What city did you meet your spouse in", "what was your first car" and "where were you born" are way too common of knowledge to work reliably. Security questions suck.

[ Parent | on HN ]

Re:Defending Against Hackers Took a Back Seat at Yahoo, Insi... by stronglikedan on Wednesday September 28, 2016 @04:09PM (#12600887)

Principal.com asked me a question about which car I've owned, and gave me a list of cars with year, make, model, and trim level. I've owned at least a dozen cars, and can't remember them all, much less in that detail. Needless to say, I failed that one.

[ Parent | on HN ]

Re:Defending Against Hackers Took a Back Seat at Yahoo, Insi... by PhantomGremlin on Wednesday September 28, 2016 @05:29PM (#12601526)

I have a similar story. I wanted to get a copy of my birth certificate sent to me. In order to do so, I had to answer some security questions, which were apparently drawn from public records.

E.g.: "what was the name of the person you bought your house from?"

Really? Not only was that transaction about 15 years earlier, but I never even met the people. They moved out of town long before their house sold. Who the fuck cares what their names were?!?! Nowadays all that stuff is done through real estate agents and title companies.

So, while filling out an online form, I'm supposed to go rummaging through 15 year old records to find the names? And what if I stored those papers offline for safekeeping (e.g. at a bank)? How long will the question on the screen remain active before it times out?

There has to be a better way of doing these things.

[ Parent | on HN ]

Re:Defending Against Hackers Took a Back Seat at Yahoo, Insi... by stronglikedan on Wednesday September 28, 2016 @06:14PM (#12601779)

I ultimately ended up calling Principal. The person on the phone asked some silly questions too, but at least she let me pass on a couple. She then reset my account and sent a link to reset my password. That wouldn't be so easy with all sites, since they don't all have reachable humans.

[ Parent | on HN ]