News for hackers. Stuff that matters.

A comment on The Effectiveness of Publicly Shaming Bad Security. Parent comment

Re:The Effectiveness of Publicly Shaming Bad Security by ceejayoz on Tuesday September 11, 2018 @05:39PM (#17963611)
> The problem with this is that most of the questions were not things that are inherently secure, things like "what was the name of your primary school" are easy to guess or research.

They're also inherently unanswerable in many cases.

As an example, I went to two different primary schools. I don't have a favorite musician or sports team, and the answer to "where did you meet your wife" might be the school, the city, or "in class".

Last time I had to update my Apple security questions a good 80% of the questions weren't ones I felt I could answer in a way that'd be memorable a few years later.

[ Parent | on HN ]
Re:The Effectiveness of Publicly Shaming Bad Security by pandler on Tuesday September 11, 2018 @08:18PM (#17964590)
Not to mention, these things are usually case sensitive. Sure, I can remember my childhood address, but how did I capitalize it? Did I abbreviate street? If I abbreviated street, did I add a period to make it "St." or "St"?

Fortunately, I don't notice too many services requiring security questions these days. Unfortunately, most of them are banks or other services that probably also have my SSN.

[ Parent | on HN ]