News for hackers. Stuff that matters.

A comment on Passwords Evolved: Authentication Guidance for the Modern Era. Parent comment

Re:Passwords Evolved: Authentication Guidance for the Modern... by chias on Wednesday July 26, 2017 @10:23AM (#14856373)
When joining my place of employment I had to fill out my I9 electronically. The website had me set up an account to store my information, and gave me the following dropdown for my secret question: https://i.imgur.com/iOsNmIk.png . For those unwilling to click, they are:

- What is your mother's maiden name?

- What was the last school you attended?

- What color eyes did you have when you were born?

- What was the last year you attended school?

So obviously you just fill in some random string as the answer, but immediately after it you had to check a box that said that you swear under penalty of perjury that all information you put into this form is accurate... I'm sure that was intended to apply to the I9 stuff but technically it includes the secret question :[

This "protects" an account that has my social security number in it, among other things.

[ Parent | on HN ]
Re:Passwords Evolved: Authentication Guidance for the Modern... by rbritton on Wednesday July 26, 2017 @01:24PM (#14858197)
Could you preface your random string?

    more secure random value instead: fd0987as0fh98a0b89safhsa
You're technically not lying then.
[ Parent | on HN ]
Re:Passwords Evolved: Authentication Guidance for the Modern... by NMDaniel on Wednesday July 26, 2017 @03:02PM (#14859124)
But then you're not answering the question, which is also bad.
[ Parent | on HN ]
Re:Passwords Evolved: Authentication Guidance for the Modern... by iak8god on Wednesday July 26, 2017 @10:22PM (#14862198)
"my eyes were brown when I was born, and here's a random string: fd0987as0fh98a0b89safhsa"
[ Parent | on HN ]
Re:Passwords Evolved: Authentication Guidance for the Modern... by MikeTV on Thursday July 27, 2017 @10:54AM (#14865864)
"Value must be 10 characters or less"
[ Parent | on HN ]
Re:Passwords Evolved: Authentication Guidance for the Modern... by nostromo on Wednesday July 26, 2017 @03:20PM (#14859275)
Just put in the MD5 of the real answer.

Instead of "blue" put "48d6215903dff56238e52e8891380c8f"

Technically, you're not lying. :-)

Obviously this would be less effective if people did this regularly.

[ Parent | on HN ]
Re:Passwords Evolved: Authentication Guidance for the Modern... by ralphm on Wednesday July 26, 2017 @05:38PM (#14860611)
#3 is blue for all newborns
[ Parent | on HN ]
Re:Passwords Evolved: Authentication Guidance for the Modern... by nailer on Thursday July 27, 2017 @08:40AM (#14864697)
Apparently that's a myth:

https://www.pregnancymagazine.com/pregnancy/pregnancy-health...

> Babies of African American, Hispanic and Asian descent are usually always born with dark eyes that stay that way.

Reference isn't great but you'll see the same thing where this topic is discussed almost everywhere.

That said, it would be true for most white people.

[ Parent | on HN ]