This was the wrong solution.
Then they started reading back random choices, which made it pretty easy to guess what I picked.
According to them, it's impossible for your mothers maiden name to have less than six characters :/
I decided to log in and change it to a randomly generated secure password. However, they had upgraded their off the shelf software some time over the last 4-5 years to a newer version.
The problem was, on their password change page the "new password" field had a minimum length of 8 characters, however the "OLD password" field also had that exact same requirement.
So I put in:
* Old: 12345
* New: 717&t!1XFCWJWk!q@ut3B
* Confirm: 717&t!1XFCWJWk!q@ut3B
And got an error "your password must be 8 characters or greater".
After swearing a few times, I breakpointed and edited the javascript validation to remove the length requirement and submitted the change again - this time got a server-side error saying the same thing.
I ended up beating it by logging out, clicking "I've forgot my password" and resetting it via email.
You probably broke law there O_O
Some of it is legacy - integrating systems built throughout the last three decades.
Some of it is management - they fired multiple teams partway through, with 100% turnover. They also massively underfunded said teams, devoting the majority of funding to PR. Also some... Interesting technical policies, like banning version control and advocating regular backups instead. (Something to do with code "theft protection").
Some of it was technical issues - different integration teams were given different browser compatibility goals. Some teams were told they must use PHP and Apache, others they must use NodeJS and nginx. Often for related parts of the UI.
If you want to know how to screw up a multi-million dollar project, look no farther.
(Source: Worked with a team leader during one of the "fire everyone" times.)
wtaf. embarrased to be aussie
Some people think they're too smart for putting a random string as their mother's maiden name. I'd rather just put something that looks like a name there.
That said, I have a peeve with one of the standard questions they ask, which is the "favorite" question. Favorite movie, favorite band, favorite song, etc. Besides the fact that I don't have One Favorite anything, does anyone actually have life-long singular favorite things? How the hell should I know what my favorite movie was 3 years ago when I rushed through some account creation process on some random website?
You have to be a bit careful with that, since some banks like to use those answers as "second factors"* when you call them. So I've gotten in the habit of using diceware-style passphrases for those, as those work over the phone better than pure white noise passwords.
*extreme air quotes
This has actually worked for me more than once, so...yeah.
I find nonsense/ridiculous answers to be safer than than random letters.
Make and model of first car? 2047 MAIBATSU MONSTROSITY
Where did you meet the love of your life? A METH-FUELED SWINGER PARTY IN A CHEAP MOTEL
etc.
Definitely more security, but _maybe_ slightly too far in the other direction.
It's like if a password field said 'no punctuation, maximum 8 characters' and your password was much longer with lots of characters; particularly if it looks random it could appear to be a corruption.
I imagine the range of given names gives most password entropy, so "family pet" might be the best question to choose, especially if you never had a family pet.
I also just avoid setting them where ever possible -- it's basically only for banks (some random website isn't going to get real answers to security questions).
The obvious corollary though, is that there really are organizations with systems that using publicly available information about, mixed with misinformation to see if you can discern an "accurate-ish" (which is sometimes not correct at all, even if you know what they think the correct answer is), and they don't even give you options about what public information they're going to select, to verify your identity.
It's usually a brief questionnaire about previous addresses, associated last names, states you paid your taxes in, and it deeps the impression that there are simply gaping, flawed security gaps at the core of everyone's financial factoids, because it's also sourced from poorly conceived paper-based bureaucratic files that never had any hope of being accurate from the outset.
The person on the other end of the phone had nothing to do with it.
In general, hopefully this uncooperative behavior adds to the general misery distributed throughout the world, and all just because security goons need to feel like they're smarter than the people subject to their policies.
Consider this, oh reader, should you have the opportunity to alter password policies for a project your working on.
They call you up and pretend to be from your bank, then ask you to open your BankID app and verify your identity so that they can share some very important information with you.
You open your app, and ID yourself, thereby logging them into your bank account on their end.
It's disgusting how twisted these criminal activities have become.
Every alternative way in is a larger attack area.
Also, keep in mind that an adversary can grab your text messages even without any social engineering skills; they just need to rent a cell tower somewhere in the world and advertise your number as roaming there [2]
As you implied, it is probably safer to use a different number than your main one for SMS-based 2FA (the much-maligned security through obscurity), but before you go out and buy a second phone plan, consider issues such as whether you will be able to receive SMS messages while traveling internationally.
[1] https://support.twilio.com/hc/en-us/articles/223181668-Can-T...
But the side effect of this is that you can’t highjack a phone number unless you highjack the cell tower between it and the network.
The majority of human beings now manage important parts of their lives online, which means they have to remember passwords.
Humans are TERRIBLE at remembering passwords - those of us who use a password manager represent a fraction of a percent of those who need one.
Secret questions may be revoltingly insecure, but they do at least let people get back into their accounts. We need to do better, but I don't know what "better" looks like.
For other passwords people should just write them down and store them in a safe place (like in there desk at home).
Unless you are running a system intended as the users primary email provider, 2FA + email covers basically all the things that “security question” auxiliary passwords are used for, with both better usability and better security. For high security cases, 2FA + in person recovery may be more appropriate.
I'd at least like the option to use Touch ID/Face ID only.
I have yet to see a site allow me to “correct horse battery staple” my password for instance (xkcd), which I’ve found very memorable.
This is the main problem and we created this problem. Over the last 30 years we worked so hard to make passwords weird and not even that hard for computers to try find. If your password is a sentence that you know by heart, say your favorite quote, the motto of your country, of your school, or some cool fact etc... your password would be (1) safer and (2) easier for you to remember. That's what I do and I never have hard time remembering my 4 to 6 word password. I just use bunch of books/movies and remember my favorite quotes. For example "one ring to rule them all" is a good password, or "may the force be with you" or "call me ishmael".
A good password has entropy, which is not a property of the alphanumeric string but of the process used to create it. Could your password generation method plausibly have produced 2^60 alternative passwords with equal probability? Probably not.
Also, never reuse passwords.
ペルソナは心の力 - read as "perusona wa kokoro no chikara"
Then I've replaced it with the English spelling of Persona -> "persona wa kokoro no chikara"
Then I replace chikara with a misreading - when I first learnt the characters, I mixed up 力 (chikara) with the katakana カ (ka) and often read both as ka -> "persona wa koroko no ka"
Then remove the (unneeded) spaces and add a "!" for good measure -> "personawakokoronoka!"
Dead easy for me to remember, but (I believe) difficult to derive/guess or dictionary attack (especially if I start with a longer sentence).
Or maybe "One And ring in to the rule darkness them bind all, them." in that it applies a personal transformation rule.
Or do both.
It's not as secure as other methods of password generation, but makes yours more resistant to (unabridged) dictionary attacks. If an attacker learns your personal salt, they could create a special dictionary attack just for your passwords, but this is another case of not outrunning the tiger when you can outrun your friend. Far easier to run the vanilla dictionary attack against everyone else who doesn't salt/transform.
Which is longer, the alphabet or the dictionary?
There's a hell of a lot more words in any language than there are characters that make them up.
N case insensitive words is far better than N character password from the normal set of characters (alphanumeric + special characters).
Even if you restrict the combinations of words to grammatically correct sentences there's still more combinations than there are of for the same number of characters
That still holds even if you make assumptions about sentence structure, common word combinations, etc, etc. There's a lot of words out there.
You're using an analysis for random words, which is completely different.
Also in general a random word is worth around as much as two random characters. There's no clear-cut winner, use whatever you like more.
> may the force be with you
> call me ishmael
These are all in my password cracking dictionary.
Was in a different country, got locked out, had to give my security question answer.... oh dear. After about 3 months occasionally sitting down and just trying out random things I meant have entered I managed to get it back.
That's not great.
Apple still does this kind of crap. Actual questions:
In what city did your parents meet? What is the first name of your best friend in high school?
Recently an airport public WiFi in a major city in Europe wanted my birthdate and the agreement language said that I acknowledge everything I'm stating is true and correct. It's so blatantly asinine. I didn't even bother to look if it cited some EU law that lying is a crime, I just said fuck it, and went without Internet for a few hours.
Not for users who've opted into two-factor authentication: https://support.apple.com/en-us/HT204915
From the page:
Do I still need to remember any security questions?
No. With two-factor authentication, you don't need to choose or remember any security questions. Your identity is verified exclusively using your password and verification codes sent to your devices and trusted phone numbers. When you enroll in two-factor authentication, we will keep your old security questions on file for two weeks in case you need to return your account to its previous security settings. After that, they will be deleted.
There are lot of questions that can have provable right/wrong answers - assuming someone powerful is out to get you. Imagine that being used against someone!
This is not, by the way, a strictly government related concern. If you lie on a credit card application (and are caught), you're going to have a bad time. But the signed bit of the application is usually completely different from where you're asked to set up "security questions".
> I've always given false info to those, when I bother to fill them out at all
Average person, not trained in using password managers, won't do it. In fact, most password managers don't support those, so you need secondary secure storage. Chances of a layperson setting up one properly and consistently using it is close to zero.
> Nevertheless, my attitude is that I'll just make sure to retain the password.
The problem is, on some sites, if you know these questions you can just reset the password. Which is insane, but unfortunately happens.
http://www.ssofficelocation.com/social-security-number-prefi...
Typically access to the account would come in a 2nd factor form like clicking on a reset password link from an email account that is yours and previously configured for such service. Only then would you be allowed to provide a new password to recover the account. Brute force protections like ensuring only a finite amount of failed attempts are necessary.
I've always given false info to those, when I bother to fill them out at all. If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in. The security questions they use are often easily guessable (although it seems now they are using somewhat better questions). Nevertheless, my attitude is that I'll just make sure to retain the password.
I get the possible security risk of answering quizzes on places like Facebook, but I've done it a few times because it's fun. It all boils down to passwords being a hassle. Almost anything you do to make dealing with passwords easier makes them less secure, but there's nothing better. The only improvements over passwords come from additional authentication factors, like having to grab a code messaged to your cell-phone, or using one of those little security token devices (or the software equivalent). I don't think anything is going to be replacing passwords any time soon.