Re:The Effectiveness of Publicly Shaming Bad Security
by ceejayoz on Tuesday September 11, 2018 @05:14PM
(#17963424)
"Oh shoot, it was a bunch of random words. I'm so sorry, I had it written down but I can't find the paper..."
Remember, an attacker can call support hundreds of times, getting a different rep every time. There's a good chance it'll work eventually.
Re:The Effectiveness of Publicly Shaming Bad Security
by metafunctor on Tuesday September 11, 2018 @05:45PM
(#17963666)
Seems to me like that’s not really a criticism against using random answers for secret questions.
Re:The Effectiveness of Publicly Shaming Bad Security
by ceejayoz on Tuesday September 11, 2018 @07:51PM
(#17964445)
Clearly random answers are a problem. You're going to find support reps inclined to accept "oh it's just something random", which means you're guaranteed get compromised if you're a big enough target to spend some hours on.
Random but outwardly appearing valid ones are fine (but you'd want to avoid using the same answer on different sites). One site's "first car" could be Porsche 911, another's Aston Martin. Both aren't true, but the support rep doesn't know that.
Never had to use these for real yet, but it should be a bit harder to be seen as a “a bunch of gibberish”.