Re:Security questions are salt
by corin_ on Monday August 13, 2012 @09:03AM
(#4375652)
You've updated to make it easier to say over the phone, but it doesn't help for being asked over the phone. Can you trust the person you're talking with to accurately say "What is the make of your first car?", or might they read "What was your first car?" or similar. Even if you specify to them over the phone "please read the question word for word", maybe their system is one with a few built-in standard questions, and all they see on their screen is "first car".
[ Parent
| on HN ]
Re:Security questions are salt
by pavel_lishin on Monday August 13, 2012 @10:00AM
(#4375886)
Why bother generating a hash based on your password and secret question? Just pick five random words and store those in your password manager as well, along with the question.
# gsort -R /usr/share/dict/words | head -n 2
inductory
thingstead
(One potential downside is having to tell an operator that your car was a "trichroic somatopsychic", which would just take extra time to spell out, unless they see the answer in plaintext.)
I want my password store to be able to generate these for me. Then it would a variation on "correct horse battery stable".
> unless they see the answer in plaintext
I think they do.
Re:Security questions are salt
by pavel_lishin on Monday August 13, 2012 @11:05AM
(#4376217)
That might actually be an interesting feature add-on.
And to avoid being faced with trying to explain how your mother was born to a ... rather eccentric family, it would be cool if it could generate something that's plausibly a family name, pet name, car, mascot, teacher's name etc.
Good thing about security questions is that they don't have to stand up to offline attacks, so a few tens of thousands of options for each might well be sufficient.
Re:Security questions are salt
by pavel_lishin on Monday August 13, 2012 @12:11PM
(#4376550)
An option for names could be a pretty good choice, but after that, the number of options could balloon. Mascot, pet's name, car brand, street name, TV show, city, etc., etc. You won't catch every edge case.
If I'm talking to someone on the phone and giving them my secret answer, I doubt they're going to be giving me the third degree about why my mother's maiden name is "antireligious electrocardiograph", especially if the computer accepts it.
There's also a risk of them changing the question text on the website. Maybe they did a redesign and need the text to fit into a smaller area - who knows.
A workaround may be to just simplify the phrase to "first car" and use that.