News for hackers. Stuff that matters.

A comment on Post a boarding pass on Facebook, get your account stolen. Parent comment

Re:Post a boarding pass on Facebook, get your account stolen by JumpCrisscross on Saturday September 23, 2017 @10:07AM (#15319787)
> The problem with this is that the "security" question will often be asked over the phone. At this point an answer of "Oh I just mash the keyboard for those" is probably going to get an attacker access to your account

I used to do this and then lost my password file. Fast forward to a call with AT&T. I told them I forgot my secret answers. They offered that it was "a super weird answer," which let me use the "mashed keyboard" line and got in. TL; DR I think this system is less safe than just making up cars, cities, et cetera.

[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by ncallaway on Saturday September 23, 2017 @12:54PM (#15320566)
Yea, I always use a handful of random words. That way, it's something pronouncable over the phone.

Still, I expect "oh, it's a random word not related to the question" would clear phone screen human layer of verification a good percentage of the time.

[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by thaumasiotes on Sunday September 24, 2017 @12:38AM (#15323337)
I can confirm that "I'm not going to be able to tell you the secret answer" was accepted by Blizzard when they locked my account and made me apply to have it unlocked.

I'm still bitter about that. I put garbage in the answer to the secret question because I planned not to forget my password. I didn't forget my password, but Blizzard nevertheless locked me out of my account, for the crime of using a payment card that was listed on my account, but wasn't listed as my "preferred" payment option.

[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by pishpash on Sunday September 24, 2017 @12:27AM (#15323306)
Yes, you should just make up a fake personal profile, and base your answers on that. True answers and human-bypassable answers are all bad, whereas fake answers open you up to a world full of entropy.
[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by ohazi on Saturday September 23, 2017 @12:44PM (#15320499)
correct horse battery staple?
[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by alphast0rm on Saturday September 23, 2017 @12:52PM (#15320557)
This is a reference to the XKCD comic, Password Strength [1].

[1] https://xkcd.com/936/

[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by isostatic on Sunday September 24, 2017 @12:06AM (#15323249)
And for those who think the reference is so well known it doesn't need citing: https://xkcd.com/1053/
[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by Chris2048 on Monday September 25, 2017 @09:48AM (#15330407)
Quite Frankly - bad math. You judge people based on how old they are..
[ Parent | on HN ]
Re:Post a boarding pass on Facebook, get your account stolen by auxbuss on Saturday September 23, 2017 @02:34PM (#15321001)
A fun place for names:

http://www.fantasynamegenerators.com/

[ Parent | on HN ]