Re:The Effectiveness of Publicly Shaming Bad Security
by metafunctor on Tuesday September 11, 2018 @05:45PM
(#17963666)
Seems to me like that’s not really a criticism against using random answers for secret questions.
Re:The Effectiveness of Publicly Shaming Bad Security
by ceejayoz on Tuesday September 11, 2018 @07:51PM
(#17964445)
Clearly random answers are a problem. You're going to find support reps inclined to accept "oh it's just something random", which means you're guaranteed get compromised if you're a big enough target to spend some hours on.
Random but outwardly appearing valid ones are fine (but you'd want to avoid using the same answer on different sites). One site's "first car" could be Porsche 911, another's Aston Martin. Both aren't true, but the support rep doesn't know that.
Remember, an attacker can call support hundreds of times, getting a different rep every time. There's a good chance it'll work eventually.