Re:Don't give away historic details about yourself
by gnulinux on Tuesday April 10, 2018 @02:30PM
(#16803805)
My problem with that is remembering and generating it. First problem is easy to solve with password managers but you still have to generate an ideally long car name with no bias. If you put some bias, then it might be backtracked. You can have a dictionary of possible car names but then you're open to attack if that dictionary is found or predictable enough that someone else can compile that list. It just doesn't feel secure enough to me.
Re:Don't give away historic details about yourself
by Dylan16807 on Tuesday April 10, 2018 @03:31PM
(#16804411)
A security question doesn't need to have a huge amount of entropy. It's probably not hashed in the first place, so computerized brute forcing isn't a worry. It just needs to stand up against a limited number of fake logins or password reset attempts.
Re:Don't give away historic details about yourself
by aaron_m04 on Tuesday April 10, 2018 @07:32PM
(#16806664)
What about those programs that generate a Markov model out of a corpus of text? You could use that to generate the answers (provided the randomness source is secure).
Re:Don't give away historic details about yourself
by vinceguidry on Tuesday April 10, 2018 @03:35PM
(#16804458)
To be fair, to actually exploit this the scammers would have to know you put in a random string. A human customer service process is not really subject to dictionary attacks.
Re:Don't give away historic details about yourself
by cortesoft on Tuesday April 10, 2018 @03:46PM
(#16804574)
Except customer service is often trying to help you remember, and you can guess a few times.... a scammer will say something like, "Oh man, I can't remember what I picked... sometimes I choose a random car model, but sometimes I just put random characters", and if either is true, the customer service rep might confirm it.
Re:Don't give away historic details about yourself
by stordoff on Tuesday April 10, 2018 @07:09PM
(#16806476)
Incidentally, I've also had customer service go the other way. I was doing a security check, and one of the questions was how long have you lived at your current address. We moved when I was about 10, so I said "I think it's XX years, let me double check: Mum, how long have we lived here, is it XX or XX+1 years?", only to get "It has to be YOUR answers". Despite knowing all the other relevant answers (random characters of password, memorable name and date, amount of last Direct Debit, down to the pence, first line of address and post code) first time and without prompting, it ended up with my account being locked.
Definitely more security, but _maybe_ slightly too far in the other direction.
This has actually worked for me more than once, so...yeah.
I find nonsense/ridiculous answers to be safer than than random letters.
Make and model of first car? 2047 MAIBATSU MONSTROSITY
Where did you meet the love of your life? A METH-FUELED SWINGER PARTY IN A CHEAP MOTEL
etc.