Re:Using a catch-all domain is a mistake
by cortesoft on Wednesday June 01, 2022 @10:17PM
(#31590534)
That is a major downside with putting gibberish in for answers to security questions… let’s hackers socially engineer support into letting you get access by saying something like, “oh man, I just mashed on my keyboard for that I don’t remember!”
You would hope it wouldn’t work, but it probably will.
That's why I always put legit but wrong answers in. Can't really guess because they're all different and made up, but also can't say, "Oh I just mashed the keyboard".
Re:Using a catch-all domain is a mistake
by brewmarche on Thursday June 02, 2022 @02:48AM
(#31592179)
That’s a good point. It’s better to use wrong but plausible answers or random sentences (some password managers can generate phrases from a word list)
Re:Using a catch-all domain is a mistake
by mellavora on Thursday June 02, 2022 @04:25AM
(#31592661)
or even better, use some random non-words. There was a post here a few months back about a service which generated non-existent but plausible sounding words.
So, your "favorite city" could be i.e. HorsecrackBay Griennstone.
Re:Using a catch-all domain is a mistake
by silverhydradev on Wednesday June 01, 2022 @08:11PM
(#31589769)
I do the same thing, but for exactly the reasons you described, this type of passphrase can be vulnerable to social engineering.
Re:Using a catch-all domain is a mistake
by nicoburns on Wednesday June 01, 2022 @08:28PM
(#31589886)
Bitwarden can generate xkcd style English-word pass phrases that can be useful for this kind of scenario.
Re:Using a catch-all domain is a mistake
by yellow_postit on Wednesday June 01, 2022 @11:33PM
(#31591012)
Same with 1Password. Has been a life saver with a family account.
Panicked phone call from a jeweller who wanted to know how and why '[their] domain was in my email address'; think he sort of understood once I explained, but still said something like 'can't be too careful in this business' - well sure ok but what am I going to do with.. oh nevermind!
Password lockout/reset over the phone, reading my 100ch 'memorable phrase' as generated by pass... Gave the guy a good chuckle, and no he was not willing to concede by the umpteenth 'upper case A' or 'backward slash' that I obviously 'knew' the phrase and could surely be relieved from reciting the entire thing... I use shorter ones now.