News for hackers. Stuff that matters.

A comment on Using a catch-all domain is a mistake. Parent comment

Re:Using a catch-all domain is a mistake by cortesoft on Wednesday June 01, 2022 @10:17PM (#31590534)
That is a major downside with putting gibberish in for answers to security questions… let’s hackers socially engineer support into letting you get access by saying something like, “oh man, I just mashed on my keyboard for that I don’t remember!”

You would hope it wouldn’t work, but it probably will.

[ Parent | on HN ]
Re:Using a catch-all domain is a mistake by jedberg on Thursday June 02, 2022 @01:08AM (#31591556)
That's why I always put legit but wrong answers in. Can't really guess because they're all different and made up, but also can't say, "Oh I just mashed the keyboard".
[ Parent | on HN ]
Re:Using a catch-all domain is a mistake by brewmarche on Thursday June 02, 2022 @02:48AM (#31592179)
That’s a good point. It’s better to use wrong but plausible answers or random sentences (some password managers can generate phrases from a word list)
[ Parent | on HN ]
Re:Using a catch-all domain is a mistake by mellavora on Thursday June 02, 2022 @04:25AM (#31592661)
or even better, use some random non-words. There was a post here a few months back about a service which generated non-existent but plausible sounding words.

So, your "favorite city" could be i.e. HorsecrackBay Griennstone.

[ Parent | on HN ]