Ask HN: What are you surprised isn’t being worked on more?

Re:Ask HN: What are you surprised isn’t being worked on more? by slg on Monday December 28, 2020 @06:37PM (#25564670)

A way for a company I interact with infrequently to identify me over the phone. Pin codes and secret questions are easy to forget when they can literally go years without being used. What was my favorite movie when I setup my ISP account in 2016? This leads to customer service reps that are too forgiving and are easily susceptible to social engineering.

[ Parent | on HN ]

Re:Ask HN: What are you surprised isn’t being worked on more? by armincerf on Monday December 28, 2020 @08:17PM (#25565487)

You'd think they would just use the same 2FA methods that are popular for logging in. 'We sent a notification, click accept on it to continue' or 'read the 6 digit authenticator code' would be re-useable for their web login and there are a ton of libraries and info that make it easy to implement.

[ Parent | on HN ]

Re:Ask HN: What are you surprised isn’t being worked on more? by mfontani on Monday December 28, 2020 @06:54PM (#25564842)

Randomize the answers to those things, and stick them in your password manager alongside (or separate from) the log-in information.

Site asks for my mother maiden's name? Let me check "pwgen 18 1"... That'll be "Viquo4cai2gienoo2p".

[ Parent | on HN ]

Re:Ask HN: What are you surprised isn’t being worked on more? by TeMPOraL on Monday December 28, 2020 @07:08PM (#25564945)

That may be vulnerable to social engineering if the person on the other side accepts "I'm using a randomly generated string of letters" as an answer :). So if your password manager accepts user-provided passwords, I'd just string two or three random words together and use that as the maiden name.

[ Parent | on HN ]

Re:Ask HN: What are you surprised isn’t being worked on more? by xavierlint on Monday December 28, 2020 @07:19PM (#25565031)

Never understood those kind of "security" questions. Is the site really going to hand out access to my account if that question gets answered correctly?

Also, some sites don't allow you to not set up one, so it's like forcing users to open up a new vector to be hacked.

[ Parent | on HN ]

Re:Ask HN: What are you surprised isn’t being worked on more? by drzaiusapelord on Monday December 28, 2020 @07:25PM (#25565075)

Charles Schwab does this with voice recognition. It certainly works, but I'm guessing its cheaper to use these legacy systems.

[ Parent | on HN ]