News for hackers. Stuff that matters.

A comment on Experian’s credit freeze security is still a joke. Parent comment

Re:Experian’s credit freeze security is still a joke by justupvoting on Monday April 26, 2021 @09:16PM (#26950584)
This implies the cs agent was able to view the password in plain text.

Yikes.

Big bank?

[ Parent | on HN ]
Re:Experian’s credit freeze security is still a joke by thaumasiotes on Monday April 26, 2021 @09:35PM (#26950746)
This is an intended part of the design of security questions. They function like passwords, but they are not conceived of as being passwords.

If the bank wasn't able to view the answers in plain text, the security questions would not be able to serve their intended purpose.

[ Parent | on HN ]
Re:Experian’s credit freeze security is still a joke by ncallaway on Monday April 26, 2021 @09:38PM (#26950775)
Security questions are typically stored with a reversible encryption so they can be used by CS agents.

Security questions are not a password.

[ Parent | on HN ]
Re:Experian’s credit freeze security is still a joke by MereInterest on Monday April 26, 2021 @10:04PM (#26951011)
Which is why security questions are a horrible idea. What good does it do to have your nicely salted and hashed password when the answers to the security questions are available in plain text and get you access to the account.
[ Parent | on HN ]
Re:Experian’s credit freeze security is still a joke by tinus_hn on Tuesday April 27, 2021 @04:54AM (#26953598)
They are just equivalent to a password, as knowing the answers allows you to reset the password.
[ Parent | on HN ]