NIST’s new password rules – what you need to know

Re:NIST’s new password rules – what you need to know by 1_2__3 on Tuesday November 22, 2016 @07:26PM (#13018921)

My suggestion: use a nonsense answer and use it for all of them. I don't reuse passwords but for exactly the reasons you state the answer to all my security challenges is something like "Because a kipper doesn't red the blue."

Alternately have a few nonsense phrases for stock challenge questions (first car, first pet, favorite <thing>, etc.) It's better than using the real (googleable) answer.

Finally, as Dale Carnegie would have loved: the more absurd it is the easier it is to remember. So while you won't remember if your favorite movie is the matrix or titanic, but you WOULD remember "I clocked blithely cookie everywhere." as the answer when you see that question.

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by koolba on Tuesday November 22, 2016 @09:28PM (#13019473)

Here's what I use to generate answers to secret questions:

    < /dev/urandom tr -dc a-z0-9 | head -c 16

This leads to things like:

> "What is your first pet's name?"

"q1ry9nftmxb1gmag"

I haven't had it happen yet, but I wonder what a customer service rep's response will be when I spell out "yrlmduihhyju5il0" when asked what my favorite color is.

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by OptimalRoasted on Tuesday November 22, 2016 @10:06PM (#13019620)

The guy on the phone laughed. I've moved to providing a few random words, easier to say over the phone than capital y lowercase r number 1.... etc.

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by CmdrSprinkles on Wednesday November 23, 2016 @11:20AM (#13023640)

Be careful with it. Was dealing with credit card stuff (raising limit to go on travel) and when they were verifying my identity the policy was evidently to combine my questions with a "background check"

Said background check basically being they googled my name.

Which you would think isn't a problem until you get to "What school did you graduate from?" and have to go through four levels of reps to explain that (not actually what I typed) "Omelette Du Fromage" was my way of making it harder to social engineer my account.

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by estefan on Wednesday November 23, 2016 @06:10AM (#13021695)

The woman on the phone at the utility company that was messing me around didn't laugh when I said the answer to my security question "what do you think of customer service" was "f*cking retards" :-D

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by jandrese on Wednesday November 23, 2016 @01:21PM (#13024544)

Who even makes that a security question? I mean seriously. You might as well ask "What is your opinion on the color yellow?"

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by koolba on Wednesday November 23, 2016 @05:23PM (#13026265)

"What is your opinion of cargo cult infosec practices, specifically security questions?"

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by lenocinor on Wednesday November 23, 2016 @07:53PM (#13027046)

Going to guess they wrote it themselves in this case.

[ Parent | on HN ]

Re:NIST’s new password rules – what you need to know by hexane360 on Tuesday November 22, 2016 @08:08PM (#13019106)

Pafwert [1] creates the absurd really well.

[1] https://github.com/m8urnett/pafwert

[ Parent | on HN ]