News for hackers. Stuff that matters.

A comment on Facebook Says Hackers Stole Detailed Personal Data from 14M People. Parent comment

Re:Facebook Says Hackers Stole Detailed Personal Data from 1... by JumpCrisscross on Friday October 12, 2018 @03:36PM (#18204103)
> wised up and switched to random 16-character responses

As an earlier comment pointed out [1], random responses to security questions are a bad idea. I've personally tested this by entering a random security answer, calling the service, saying I forgot my password and entered gibberish as my security answer, and being let through. I presume technically-savvy people think this is more secure; if I can guess that, an attacker can too.

[1] https://news.ycombinator.com/item?id=18203907

[ Parent | on HN ]
Re:Facebook Says Hackers Stole Detailed Personal Data from 1... by ryandrake on Friday October 12, 2018 @03:46PM (#18204162)
I’d love to know which businesses have such an asinine policy. Name and shame! They are basically allowing a password reset with zero authentication.
[ Parent | on HN ]
Re:Facebook Says Hackers Stole Detailed Personal Data from 1... by jjeaff on Friday October 12, 2018 @04:35PM (#18204518)
Company policy wouldn't matter as much as just getting the wrong customer service rep that is trying to be a bit too "helpful".

In social engineering, it is common to call back multiple times looking for a gullible customer service rep. Even using a recording of a crying baby in the background to Garner sympathy is something I've seen done.

[ Parent | on HN ]
Re:Facebook Says Hackers Stole Detailed Personal Data from 1... by lapnitnelav on Friday October 12, 2018 @06:23PM (#18205140)
Any business large enough to have call centre like operations - and the cost-centre mindset that goes along - where people are underpaid and pressured to take as many calls as they can?
[ Parent | on HN ]
Re:Facebook Says Hackers Stole Detailed Personal Data from 1... by feanaro on Saturday October 13, 2018 @04:18AM (#18206986)
Naming and shaming of sufficient magnitude would put pressure to select for more strict customer service representatives. If they could get fired for doing that, they would think twice.
[ Parent | on HN ]