Password Resets Worse Than Reusing Old password

narramissic writes "We all know well the perils of password reuse. But what about the information used to reset passwords? Many sites use a standard set of questions — your mother's maiden name, the name of your best friend, what city you grew up in, or what brand your first car was. And you probably have a standard set of responses, making them easy to remember but not very secure. 'The city you grew up in and your mother's maiden name can be derived from public records. Facebook might unwittingly tell the name of your best friend. And, until quite recently, Ford with its 25% market share had a pretty good chance of being the brand of your first car,' says security researcher Markus Jakobsson. But 'password reset does not have to be a weak link,' says Jakobsson. 'Psychologists know that people's preferences are stable — often more so than long term memory. And very few preferences are recorded in public databases.'"

Comments

Are there any good solutions?

[Anonymous Coward]

'The city you grew up in and your mother's maiden name can be derived from public records.'

I don't know if you can find the city that you grew up in in public records, but I know that in Minnesota, I can get anybody that get your name, date of birth, place of birth, mother's maiden name, father's name from just a few clicks on the 'puter. (for free)

Many folks put other personal details on their blogs or other places online and it doesn't take much to find quite a bit about their personal lives. Add that with just a touch of social engineering, you can get a bunch of data about your target.

Even if the questions are secure, many times the mode of delivery/reminder is not. I don't know how many times I have had to reset/get a password renewed by asking all those stupid questions on a secure web page just to have them resend a password free text to my yahoo account. These aren't important sites to me, but I still wouldn't want anybody snatching this data.

This preference method has flaws too. I change my preferences often. So it may has some good points, it looks rather like a marketing gimmick to me. How long would it take for your likes and dislikes to be sold to the spammers?

Re:Are there any good solutions?

[zappepcs]

The only set of questions that are any good are the set that you can make up yourself. At my bank, they ask what was the drill instructors name if I was in the military... how the hell do I know, all I remember is 'fuckhead'

They never tell you whether spaces count or not. I would like a password reset that involved two network methods: Okay, I change it, but it doesn't count until I send a text message from my phone too, or something like that. Verification via email is good, but off-net authentication would be better. I wouldn't even mind that kind of authentication for access on a regular basis, say if my account is accessed by a pc that either does not have a cookie already or that is not used normally to access my account. Picture or background validation is also good against phishing, but let me upload my own pic? please? No matter how random I make the pic, it will always be something I know, and can update regularly. I mean, what's better than a simple text graphic for background that simply says "fuck W" or some other phrase you will remember?

Security could be much simpler than it is, much better than it is. There seems to be no inspiration to implement it. That second network usage is invaluable. Give me a screen to pick one of several options (configured in preferences) such as cell, landline, SMS message, pager etc. I pick (and provide phone number) and you send the one-time authentication code that is in addition to my normal login credentials. It's easy really.

The same authentication security can be used for password resets. Send a temp password to pre-authorized off-net device or address, or let me set the new temp password via telephone etc. It really isn't that difficult.

Re:Are there any good solutions?

[cjb658]

There are a lot of sites I don't want to give my phone number to.

Re:Are there any good solutions?

[zappepcs]

you can use throw away or unassociated voice mail services like http://www.voicenation.com/ if you wanted, or a phone at the library if needed etc. The point is that being able to use POTS lines is important for many people still, and it is off-net. I agree with your sentiment though.

Re:Are there any good solutions?

[techno-vampire]

At my bank, they ask what was the drill instructors name if I was in the military... how the hell do I know, all I remember is 'fuckhead'

So use that as the question and Fuckwit as the answer. No problem. It's not as though anybody is going to check to see if the answer is a proper name or anything.

Actually, now that I think about it, there's no reason that there has to be any logical or rational connection between the question and answer, just as long as you remember what it is. I mean, is anybody at your bank going to complain if your answer to the question, "What city did you grow up in?" is, "Judy Garland," and if so, why?

Re:Are there any good solutions?

[zappepcs]

Dude, you don't get it ROFL
If you can't get logged in, when you call their help desk they ask you the questions! You have to give some soft spoken girl the answers... ROFLMFAO

I thought about 'eatshitcunt' as an answer, but that just wouldn't work out right

Re:Are there any good solutions?

[UncleTogie]

Actually, now that I think about it, there's no reason that there has to be any logical or rational connection between the question and answer, just as long as you remember what it is. I mean, is anybody at your bank going to complain if your answer to the question, "What city did you grow up in?" is, "Judy Garland," and if so, why?

Dang. Busted.

This is one of my fave tricks. I have a standard set of answers to match those questions, and as you indicated, they have NOTHING to do with the question. Simple, basic, and with multiple possible answers per question, I just try the first, then second if the first doesn't work, etc....

Re:Are there any good solutions?

[Nebu]

At my bank, they ask what was the drill instructors name if I was in the military... how the hell do I know, all I remember is 'fuckhead'

So use that as the question and Fuckwit as the answer. No problem. It's not as though anybody is going to check to see if the answer is a proper name or anything.

Right away, you see the problem with this approach. The GP wrote "fuckhead", and within 5 seconds of reading this, you already forgot that it was "fuckhead" and wrote "Fuckwit" instead. Not only did you get the word wrong, but you capitalized the "F" when the GP did not.

Actually, now that I think about it, there's no reason that there has to be any logical or rational connection between the question and answer, just as long as you remember what it is. I mean, is anybody at your bank going to complain if your answer to the question, "What city did you grow up in?" is, "Judy Garland," and if so, why?

Your bank isn't going to complain, but your future-self is going to. I got a bank account as a teenager, and one of the security questions was "What is your dream job". 10 years later, they asked me what I had put as my dream job. I completely blanked out. I remember I wanted to make videogames when I was a kid, so I tried "video game programmer", "videogame programmer", "game programmer", "game developer" and they were all rejected. Well, I was also in a rock band for a while, so I tried "rock star", "musician", etc. Nothing worked. In the end, I had to visit the bank in person, which meant taking some hours off of work, which was inconvenient because we were in an overtime crunch period.

And this was for a question that I assumed I had answered earnestly (as opposed to "growing up in Judy Garland"); except it was merely a question that didn't really have a great significance to me, and so my answer likely changed with time. So unless you really have a strong memory associated with "growing up in Judy Garland" (perhaps because of some sort of inside joke), it's probably best not to try to be "clever" with these security questions.

Re:Are there any good solutions?

[techno-vampire]

Not only did you get the word wrong, but you capitalized the "F" when the GP did not.

As far as getting the word wrong, all I can say is mea culpa. I was looking at what I quoted, but not paying attention. I capitalized it because there's a chance that the site's checking for that. (Not capitalized is presumed not to be a name.) As far as using Judy Garland for your city, I just picked the first thing that came to mind. Why Judy Garland came to mind right then I can't say, but it did. The point is, the answers don't have to match the questions as long as you know what they are. And, as far as your problem with answering the "dream job" question, any question who's answer is likely to change with time probably isn't a good one to use. Yes, I know you didn't pick it, but whoever did picked a bad one.

Re:Are there any good solutions?

[Anonymous Coward]

Actually here in Europe all the banks use some form of auth, different than just password. Be it One Time Password generator token, OTP list, temporary PIN, valid only for that session, send to your cell or certificate on a smartcard. Solutions like this are available from ages - just check VASCO, Entrust, RSA, etc...

Re:Are there any good solutions?

[Anonymous Coward]

Well the easy solution is to use a random string of characters.

"My first pet was 4fgTY2k11."

Make sure you use numbers and both lower and upper case letters at least.

How are you gonna remember this in 10 years though? Easy! Store it in a file called "passwords.txt" in your My Documents folder. Works for me!

Re:Are there any good solutions?

[joggle]

I think that's a bit too extreme since the whole point is to make it even easier to remember than your password.

What I always do is tell a small lie that I can guess quickly. For example if the question is what my elementary school then answer with another regional school. I don't actually use that pattern but it's something equally simple that is really easy for me to remember.

Re:Are there any good solutions?

[laejoh]

You have to give some soft spoken girl the answers... ROFLMFAO

Damn, they know our weakness. I bet that's what sex feels likeç

Re:Are there any good solutions?

[houghi]

I grew up in "You are completely retarded if you keep asking me these stupid questions."

Re:Are there any good solutions?

[Bastard of Subhumani]

The point is, the answers don't have to match the questions as long as you know what they are.

...and can remember them. I locked myself out of a bank account I hadn't used for some time because I'd given false answers on the security questions then forgotten them.

Re:Are there any good solutions?

[RMH101]

SOME not ALL. in the UK Natwest have recently offered a generator token that you put your debit card in, but this is the exception, not the rule. None of my 5 bank accounts have anything more than boggo passwords on them...

Re:Are there any good solutions?

[Kent Recal]

I think you missed his point.
As I understand it he's (rightfully) complaining that most security questions allow (or even cry for...) an ambigious answer.
This is even more of a problem when you have to later re-type the answer into a webform as those are normally not very forgiving wrt variations in syntax or spelling.

Btw stuff like "What is your mothers maiden name" or "What city did you grow up in" does not count as a security question because such info could easily be figured out by an attacker.

Re:Are there any good solutions?

[toleraen]

I got a bank account as a teenager, and one of the security questions was "What is your dream job". 10 years later, they asked me what I had put as my dream job.

This is what drives me nuts. When most places have a series of questions to select from it's always mothers maiden/first car/etc, which I never want to answer. If they do have something other than those, it's "What's your favorite author/movie/food/band". Well that's helpful, it's whatever book I just read / movie I just saw / what I'm making for dinner / what's going through my headphones. Three weeks later, they're useless.

It's forgetting those types of answers that drove me to using a generic answer for each question. It'd be nice if places started allowing you to type in your own question, or ask extremely obscure questions with answers that shouldn't change.

Re:Are there any good solutions?

[pablo.cl]

It's very obvious. The elementary school is that of your wife. Your mother's maiden name it's actually your mother-in-law's maiden name. Should you ever forget what your wife's firt pet was, a simple call will solve the problem (if she's not within voice reach). And she would never tell that answer to a stranger.

Re:Are there any good solutions?

[Cro Magnon]

One of the security questions was the name of my pet. I don't have a fscking pet and never did. I ended up "borrowing" one of my mom's pets for the occasion. Hopefully when I forget my password, I'll remember which of my mom's 101 pets I used, and whether I capitalized the name.

Re:Are there any good solutions?

[Anonymous Coward]

For sites that want phone numbers, but I don't want to give them my phone number, I use 123-456-7890. Since I live in the US, that looks like a valid US phone number (3+3+4 digits). I've never had a site notice that "123" is not a valid area code.

For sites that want an email but I don't want to give it to them, I usually try "NO WAY" first. If their page validation complains that it is not an email address, then I go with nospam@invalid.com or noway@example.org or whichever strikes my fancy at that moment.

Re:Are there any good solutions?

[eth1]

The best solution is to ask for both the question AND the answer. On the few sites that do it this way, I use "questions" that wouldn't even have meaning to anyone but me, but that I can instantly provide the answer to.

As an added bonus, certain family members, who I would actually WANT to be able to guess these in case something happened to me would be able to figure them out with a minute or two of thought.

Re:Are there any good solutions?

[bsims]

This is what drives me nuts. When most places have a series of questions to select from it's always mothers maiden/first car/etc, which I never want to answer. If they do have something other than those, it's "What's your favorite author/movie/food/band". Well that's helpful, it's whatever book I just read / movie I just saw / what I'm making for dinner / what's going through my headphones. Three weeks later, they're useless

Or my favorite: canned questions, and a minimum length allowed for an answer.
Um, perhaps the name of my first dog was less than six letters long.

Re:Are there any good solutions?

[Lord Apathy]

Call And Bitch! These people are here to serve you, not the other way around. You don't like their security bullshit every time you encounter it, pick up the phone and let them know.

My fucking bank got the idea everytime I would log in it would ask me the name of my dog. I got sick of it, called and bitched. The bank bitch told me that this was a law now and it would I would be required to answer it. I just said everytime I saw it I would call and bitch and you would have to reset it.

It went on like this for 3 weeks. I would ask me my dogs name, I would call, and bitch every day. I was even told that they wouldn't' do it any more. Which I said yes you will because you required too. After about 3 weeks I noticed that it stopped asking me my fucking mutts name.

If enough people give them hell about their bullshit then they will stop.

Re:Are there any good solutions?

[PitaBred]

You should really just use any address at example.com, .org or .net. invalid.com is a valid server, and you don't want to subject them to the spam, now do you?

Re:Are there any good solutions?

[Anonymous Coward]

It's even better when you're talking to some customer service rep on the phone and they ask for the answer to the secret question, and it's "fuckoff"

Re:Are there any good solutions?

[Anonymous Coward]

These are the actual password recovery questions for the University of British Columbia's campus-wide login system. You're required to select one from each set of five. So many of these would drift over time it's insane.

What is your first boss' first and last name?
What is the first phone number you remember?
What was your favorite place to visit as a child?
Who is your favorite actor, musician or artist?
What was the last name of your childhood best friend?

Where did your parents go on their honeymoon?
Which city outside North America did you first visit?
What was your favorite game as a child?
What was your favorite subject in school?
What street did you grow up on?

What is the name of the city your mother was born in?
What is the first and last name of your first love?
Who was your most memorable school teacher?
What is the first musical instrument you ever played?
What was the first job you ever received pay for?

Re:Are there any good solutions?

[Anonymous Coward]

I use random strings for password. Those random strings are usually things I remember my old girlfriends had written on some of their ID cards, such as K391T, H3G9K82, etc. One site wouldn't let me use digits as part of the answer. Surprisingly, it turned out it would only let me use lower-case letters, no punctuation, no spaces, no capitals, no numbers. On the other hand, they had me use letters and numbers and at least one special character (whatever, to me using "%" or "~" in a password you use ONE time, to post a comment on someone's blog, is gay anyway). THIS is what is bothering me. I have about 20 passwords and 20 "secret answers." These lists were made up over the years and I'm pretty sure I won't forget any of them in the near future as I constantly rotate them and I've made up ways of deciding which password and s.a. should go with a given account which only I know.
I'm not 100% secure because I reuse most of the passwords and if someone found out what one of my passwords was, they might still find a way to damage me by trying it on any account I have and they know of. And at this time YOU're going to call me paranoid, after YOU decided that I should have complex passwords and systems for remembering them without noting anything down and YOU were the one to say that I should use multiple passwords.
If you don't see where I'm going with this, here's a hint: YOU are the one making me paranoid and I don't like it. YOU are the one asking me to make up strong passwords which require up to five hands to type and three notebooks to help me "remember" them for any worthless piece of shit you consider. YOU are annoying me by asking me to constantly change my password. I set a password and I know why I set that password. If you're asking me to change it, you're only going to confuse me and mess up my whole system on which just about everything else relies so I'll probably have to write down somewhere that this is the only website/computer/service that needs a special password and pray for nobody to find it.



Long post. Unfortunately everything I said in the first paragraph is true. I am paranoid.

Re:Are there any good solutions?

[Anonymous Coward]

And she would never tell that answer to a stranger.

Actually, many people would give out their passwords for a candy bar, sometimes with their username. One or both is pretty much useless until it is known what the username and password is for. In my previous job, I had a username Administrator with a password of jr7sw90... not very helpful unless you know what it's for.

Re:Are there any good solutions?

[Anonymous Coward]

I diagree. It is best to enter random strings that you never remember for the secruity questions. Visting the bank in person isn't that bad if you aren't unlucky like you were.

If the security questions are destroyed with random strings the attackers only have two roads, social engineering in person at the bank or breaking your hopefully strong password.

Why have a large set of questions that all can unlock the account? It is best to just have a few strong access methods than having many.

Re:Are there any good solutions?

[Anonymous Coward]

As someone who does work in this area, I can honestly say that it is not that easy.

Give me a screen to pick one of several options (configured in preferences) such as cell, landline, SMS message, pager etc. I pick (and provide phone number) and you send the one-time authentication code

If you are providingthe phone number, how does it help security. We probably do not know all your phone numbers (or maybe not any).

The same authentication security can be used for password resets. Send a temp password to pre-authorized off-net device or address, or let me set the new temp password via telephone etc. It really isn't that difficult.

You can't do it if you don't have everyone set up for it. Not everyone has cell phones, house phones are only useful if the member is at home. The people setting up the accounts don't always get the information. Why? Who knows, I am just the fucking programmer, but the simple fact is FIs see these types of authentication schemes as impossible to implement for all of their members. If the process is not going to work for even a small portion of their member base, then they are not going to buy it. It has to be as simple as humanly possible, without requiring any other physical devices. They would never even have muddied it up with dual authentication schemes if the powers on high did not make it a requirement last year. The bottom line is: Nobody wants to be the financial institution with a more complicated login scheme than some the other institutions.
 

Re:Are there any good solutions?

[gremlin484]

Back when I had cell service with Sprint, I would change my online password to things like "sprintsux" or "eatmyballs" or "fuckoff" right before I called into their customer service line

They would make me recite my password over the phone

Somehow it made the shit-service feel a little less painful

Re:Are there any good solutions?

[ivan256]

Use mailinator.

Re:Are there any good solutions?

[sasdrtx]

Ha-ha, too bad you were calling a phishing site. Sprint doesn't ask for your password, nimrod.

Re:Are there any good solutions?

[wilec]

I had used DUCKU2 as the answer to a secret question at my bank once, had to tell both the clerk and her manager, they seemed to enjoy it though. Kinda like getting people to try and replicate the noise of a failing drive or A/C unit over the phone, (switch to speaker) could you repeat that please? "squealllll, chunka, chunka, squeellll". Sadly this often passes for entertainment around the shop, yea we are a pretty easy bunch to entertain.

wabi-sabi
matthew

Re:Are there any good solutions?

[zappepcs]

It's kind of funny, when I worked in the dev lab of a large telecom company Sun sparc workstations were everywhere. They were all set up correctly for network logins etc. but the IT group was slow to grant access so visiting field techs were often asking for someone's password so they could get on the network and use the workstation. I quickly changed my password to 'fuckoff' and hilarity ensued.

Field guy: Hey, can I use your login for a minute?
Me: sure
Field guy: what's the password?
Me: fuck off!
Field guy: sorry, thought it was ok??
Me: it is ok, no problem.
Field guy: ohh? what's the password?
Me: fuck off!

who's on first blah blah blah

and several other variants of the same conversation.

Re:Are there any good solutions?

[DDLKermit007]

You do know the mother's maiden name isn't supposed to be her maiden name right? Your supposed to just have a codeword essentially at that point.

Even worse...

[Shados]

Even worse is that some of those system are freagin picky too.

You may know the answer. But it may be case sensitive, and fairly picky. "Whats your favorite food". Is it Curry, curry, curry chicken, Curry Chicken, chicken, Chicken?

I got locked out of my bank account because of that BS once (it wasn't a password reset though, it was a 2 step authentication, so it asked that on TOP of the password)

Re:Even worse...

[Wrath0fb0b]

Unless your time is worth more than $2000/hr, better locked and inconvenienced than compromised.

Re:Even worse...

[Shados]

Of course, I cannot put non-alphanumeric characters or more than 9 characters in my password.

So its kind of inconsistant.

Re:Even worse...

[Beolach]

You either didn't follow the link in the blurb, or you're referring to some of the existing systems - in which case I agree w/ you. The way they did it was a setup step, where you selected 8 likes and 8 dislikes. Then when you need to authenticate, it shuffles those 16 items, and you select whether you like or dislike each item - no spelling required.

Re:Even worse...

[yehooti3]

At work we have so many passwords for so many company sites that I have to write them down because they keep getting reset. No security here because the annoyance of this has caused me to post the current ones near my monitor. I'll cross out the old one and write in the new one. Sure, I scramble it a bit, but the fact that I have to resort to that kind of obfuscation and keep them near is troubling. Better, I think, that I have a strong password that can stand for a year or more, and that I can keep in my head.

Re:Even worse...

[fishbowl]

What musical instrument do you play?

I am equally proficient on Piano, Guitar, and Flute. I have university degrees based on two of those. It's actually hard to remember what I answered, and it kept coming up as a question on some website.

What is your mother's maiden name?

This one is weak in both gender-specific and age-specific ways, as well as being culturally biased toward that segment where women "marry" and "change their names."

Re:Even worse...

[Anonymous Coward]

offtopic rant about stupid bank (in)security ahead. my bank told me i the option to pick a 6 digit code for my account for telephone banking; I gave them a number and they told me it was no good because it had repeated digits. I told them not to bother with it and I'd just ID myself using personal details and the bank told me that was fine but the system needed a number so they would set it to 123456. so a 6 digit number with a single repetition is "unsafe", but the most obvious fucking choice that an idiot would choose is ok?

and dont get me started on banks requiring codes to be a fixed length. one bank i no longer deal with would only allow a 3 digit phone pin, and a 6 character online banking number. 3 digits isnt long enough to be memorable and 6 digits is to short to use one of my memorised gibberish strong passwords. it's like their it departments are populated by morons

Re:Even worse...

[RazzleDazzle]

you could just always make sure to use the same case regardless of it being a proper noun or not. for example if the question is "What was the name of the city in which you went to first grade?" and the city is let's say "St. Petersburg" you would just always use "st petersburg" using all lower case and omitting any punctuation. Easy to recall as there is never any variation. Maybe it reduces security but do you want to actually use the service? If not, cancel your online account.

KISS - keep it simple [stupid|silly]

Re:Even worse...

[Tubal-Cain]

Let me guesss... 42? 1337? 3.141592653589793helpimtrappedinauniversefactory7108914...?

Re:Even worse...

[Shados]

I was indeed giving an existing system as a point of reference to compare the article to.

Re:Even worse...

[avatar4d]

I got locked out of my bank account because of that BS once (it wasn't a password reset though, it was a 2 step authentication, so it asked that on TOP of the password)

Would you rather get temporarily locked out of your account or rather someone who is not you get in?

I am not saying that there are not alternative ways to gain access, but for me personally I would choose the former of the two. Although following CIA (Confidentiality, Integrity, Availability) philosophy there is obviously a potential to leave the last in a non-existent state. But in banking, is this really so bad?

Re:Even worse...

[richardellisjr]

That's one of the most irritating things. I use a 12 character password, mixed upper and lower case, with two punctuation symbols, and no dictionary words and it's still insecure because it doesn't have a number?.

I wish there was a password standard everyone would adhere to, as it stands my more than complex enough password is impossible use everywhere because some sites require numbers, others won't allow certain symbols. What's the point in no punctuation I know that it's going into a database that allows punctuation in it's columns.

Re:Even worse...

[CastrTroy]

My bank does that too. I just filled it with random character strings generated and stored in PasswordSafe. A lot more secure, than, so when they ask what is the name of my highschool, my answer is something like "EE38e9Eeeicf3232". Which is really nice, because it helps to make up for the insecurity of their 8 character alpha numeric passwords.

Re:Even worse...

[Nushio]

Thats why I use random gibberish as a question, and rot13 that and use as the answer.

Posting anonymously because I don't want you to look into my accounts and attempt to get into them!

Re:Even worse...

[Nushio]

OH, so I'm supposed to mark that checkbox up there?

Re:Even worse...

[camken]

i prefer using barcode passwords with a barcode reader.. easier than remembering them, and i can keep a 'list' of my passwords in my wallet which, even if stolen, still most likely wouldn't mean anything as i use shorthand to describe everything and the barcodes aren't printed alongside (usually i use stuff like my pack of cigarettes, a can of beer, etc) and if i ever need to get a password hint from a site i fill out the answer as the object i used to generate the password.. the nice thing is that they're nearly random, easy to remember mnemonics, and generally strong.. then i just keep a good high-security password for banking purposes..

Re:Even worse...

[techno-vampire]

I used to work for an ISP doing tech support. Much of our work required us to be logged into several webpages on our local intranet; not only were they behind our firewall, you couldn't even reach the login pages unless you were physically on-site. Then, somebody in IT got a bug up their ass about security and passwords. Not only did they require 10 character passwords, they had to be mixed case with a number and a punctuation mark. (Of course, requiring all that just lowered the search space for a brute-force attack.) And, of course, they had to be changed every 60 days and couldn't repeat. It was a royal PITA, and not just for me, for everybody, and all for nothing because nobody who wasn't authorized to use those sites could have reached them, let alone log in. Then, once you'd logged in, you'd get about half a dozen messages about outdated certificates, because nobody in IT could be arsed to get new ones, and the computers were so heavily locked down that we couldn't tell them to ignore the certificates and have it survive a reboot. (Just to put a cherry on top, we were using a version of NT 4 that was so unstable that most of us were rebooting several times a day.)

Re:Even worse...

[Shados]

Hahahaha... Thats a lot of Fail if I've ever seen Fail :)

Re:Even worse...

[Nebu]

Unless your time is worth more than $2000/hr, better locked and inconvenienced than compromised.

You can't just look at the gain/loss of the two alternatives and decide which is better merely from that. You also have to take into account the probability, and multiply the gain/lost by the probability.

For example, if you make $40/h, and you access your bank account 5 times a month, and it takes you an extra 60 seconds, because of the inconvenience of the added "security" questions, and if you still have a good 30 years of employment left, then over your life, the questions would have cost you $1200, and that's assuming you never get a raise. The security questions are always there, so you have a 100% chance of being inconvenienced each time you try to access your account.

Most people don't get their bank accounts broken into, even without security questions. Let's be pessimistic and imagine 1 out of 1000 people who don't have security questions get hacked. Let's say the security questions are really secure (i.e. not merely "what is your maiden's name") and they actually halve the chance of getting hacked, even though you post a lot of your personal information such as your favorite color, or your dog's name on Facebook. If you only ever keep about $5000 in your bank, then the security question have lowered your risk from 0.1% (i.e. $5) to 0.05% (i.e. $2.50)

So would you rather get $1200, or $2.50?

Re:Even worse...

[mike9989]

Oh to get back those modpoints I had earlier!

Re:Even worse...

[Iron Condor]

but the system needed a number so they would set it to 123456.

Wow -- that the same number I use on my luggage.

Re:Even worse...

[profplump]

You're assuming the two are mutually exclusive. In most of the examples I've seen, I can both be annoyed/locked out regularly AND have someone else gain access. Even with the recently mandated two-factor systems, many banks still as you to log in using a 4-digit numeric PIN, plus some bit of personal trivia -- better than just a PIN, but probably not as good as a strong password.

Not to mention the shared passwords required on joint accounts at many banks. I trust my partner with my money, but that doesn't mean I want them to impersonate me when logging in -- access control and authentication should be separated. This problem is only complicated by the personal-trivia questions, as you now have to remember someone else's personal trivia and capitalization habits.

Is there some reason the bank couldn't just send me a list of one-time passwords on a wallet-sized card every month (or whenever I exhaust the list)? A one-time password plus my usual account password would be much better security, and easier to use. It would cost almost nothing, it would have no relation to public data or my personal preferences, and there's nothing I need to remember beyond my standard password.

Re:Even worse...

[Anonymous Coward]

Unless your time is worth more than $2000/hr, it's better to take your shoes off at the airport than risk a terrorist attack.

Re:Even worse...

[eugene ts wong]

You're lucky. I'm still confused by what happened to me.

He said, "Mr. Wong, your confirmation question is, 'What did Eve first say, when she saw Adam?'.".

"Hmm, that's a tough 1."

"Yes, that is correct. Now, the deciphering question is, 'How does a foobar ask a question?'.".

"What?"

"Yes, that is correct. Will there be anything else for you today, Mr. Wong?".

Re:Even worse...

[avatar4d]

Actually I didn't assume that at all. I said:

"I am not saying that there are not alternative ways to gain access, but for me personally I would choose the former of the two."

I also didn't postulate alternative solutions. I was merely making a point that I would rather be annoyed than have access given to someone that wasn't me.

Re:Even worse...

[mr_mischief]

One-time passwords aren't a bad idea at all.

If the banks are really interested in security, though, why don't they give you a USB drive with a trusted browser program that generates your very own public/private key pair when you first sign up for online banking? If the teller or customer service window is the perfect place to deposit a check, it's the perfect place to deposit your public key.

Actual cash is involved in very few of a bank's transactions these days, so secure storage and transfer of data are really the heart and soul of their business. If their servers are secure enough to store private information like your balances and transaction history, then surely they're secure enough to store a public piece of information like an RSA public key.

Re:Even worse...

[DJ Manning]

Try banking with my local bank then. They give the option of security tokens. A new 6 digit one use only number every 36 seconds. They also have two models of tokens to choose from, the simple one, or one with a keypad that requires you to enter a pin before you can view the authentication key. http://www.bendigobank.com.au/public/about_us/types_of_banking/types_e-banking_security_tokens.asp

Re:Even worse...

[Anonymous Coward]

Solved the problem. The local bank wanted to beef up security and required us to pick an object like a vase or teapot (how lame) and then answer lots of questions like name of high school, where you were born and lots of questions for whom answers they need not know so the answer remains the same line of poetry in lower case whatever question anybody asks. Works perfectly.

Sadly the workplace didn't like my coding of the date as my password when I had to change it every 3 months because the passwords were all so familiar so I used the date and then I made it more complicated and changed the password everyday.

Re:Even worse...

[J.Y.Kelly]

He said, "Mr. Wong, your confirmation question is, 'What did Eve first say, when she saw Adam?'.".

"Hmm, that's a tough 1."

I'm sorry Mr Wong - the answer should have been "Hmm, that's a hard one".

Re:Even worse...

[Swizec]

Dude, USERNAME? Don't you use a certificate to identify yourself ... and I thought my e-bank had poor security.

Re:Even worse...

[BlockedThreads]

I hope you don't mean you use the same password everywhere. If so, CmdrTaco has access to your bank account ;-)

Re:Even worse...

[FooBarWidget]

If you reason like that, then going to the toilet will cost you more money in the long run.

It doesn't matter how small a number is, if you add up enough of them then it will become a large number.

Re:Even worse...

[Zironic]

Also you're most likely insured against hacking so your average loss would be even less. It's much more in the banks interest to keep the accounts secure becasue it's them that have to pay up when they get hacked.

Re:Even worse...

[sjwt]

Some of the banks over hear offer you that for a once off fee, other optiosn are SMS'ing to your phone.

Re:Even worse...

[OolimPhon]

If the banks are really interested in security, though, why don't they give you a USB drive with a trusted browser program that generates your very own public/private key pair when you first sign up for online banking?

Good luck getting a bank that will provide you with a program on a USB key that runs under anything else than Vista...or just possibly XP.

You're a typical Slashdotter, no? Runs Linux|Mac|BSD|C64? How are you going to use that USB key? Wine?

Re:Even worse...

[Kent Recal]

Ehm. If your bank account can lose money only by someone guessing your password then I'd strongly suggest to switch to a bank that requires TAN authorization for transactions...

Re:Even worse...

[Anonymous Coward]

Wait, was it "spam, spam, spam, spam, spam, spam, spam, spam, eggs and spam", or was it "spam, spam, spam, spam, spam, eggs and bacon and spam", or maybe I used "spam, spam, spam, spam, spam, spam, spam, spam, spam, spam, spam, spam, spam, spam, eggs and spam without the spam". I can never remember!

*cue vikings*

Re:Even worse...

[halcyon1234]

I got locked out of my bank account because of that BS once (it wasn't a password reset though, it was a 2 step authentication, so it asked that on TOP of the password)

You mean a "Wish-It-Was" two-step authentication.

Re:Even worse...

[thrykol]

For those who feel the benefits of a security question are suspect at best, just use the name of the institution requiring it. Always use upper or lower case and it is not difficult to remember.

Re:Even worse...

[pablo.cl]

One time passwords can be set this way:
__A__B__C_
1 84 53 28
2 76 23 09
3 21 78 02
Password 1: A2 B1 C3 = 76 53 02
Password 2: A1 A2 B1 = 84 76 21
Password 3: B2 B3 C2 = 23 78 09

If you have 10 letters and 5 numbers you'll never run out of passwords during your life.

Re:Even worse...

[omfglearntoplay]

Hell, i wasn't even thinking. yeah, for the really important ones (your bank) make the answers impossible to guess if you want to be really secure. I'm serious... random strings of text for answers isn't a bad idea if you never forget your real password and you don't want it reset by a clever hacker-cracker type.

Re:Even worse...

[omfglearntoplay]

Yeah, but if you don't buy a coke every day for the rest of eternity, let's assume cokes never go up in price for fun, that's $.50 * infinity = you are a kazillionaire!

Tiny numbers over a huge amount of time always equal a big number but it never represents real life very well. Sure, it's 60 seconds of your time here and there. But how about less security up front, then you get your bank account and money stolen, your credit goes to hell, you lose your house, car, wife, and kids. That's only going to waste 2 hours a day for a week, 40 x 2 x 7 = $560! What a deal!

Re:Even worse...

[gurps_npc]

Here is a secret to making secure passwords that you won't forget. Username: Franklin. Web site: www.washingtonmutual.com Favorite ice cream flavor: 31 Password: FRANWASH31 Same guy, different web site: Username: FCROMWELL Web site: www.ebay.com Password: FCROEBAY31 -------- This is a 'rule based' password system. Hint: Don't use the same rule I just used, make up your own.

Re:Even worse...

[blhack]

I did a similar thing to this in college, except i didn't carry it around with me.

There was a brand of Olive Oil called "De Cecco" that I almost always had at my desk (i ate a lot of bread and olive oil).

The password for my email account was a combination of the name of the Olive Oil and the numbers in the barcode....say the bardode was "6066" my password was d6e0c6c6. I thought it was sweet....all I had to do was go to the store and buy a bottle of olive oil to log in to my email.

This worked until I moved to a place that no longer sells de cecco olive oil.

DAMNIT!

Re:Even worse...

[Anonymous Coward]

If you could go the rest of your life without ever visiting the toilet (ignoring any by-proxy pleasures you get out of it), wouldn't you jump at the chance? I know I would...

Re:Even worse...

[mr_mischief]

All of the above plus Windows and a few others. I've got a pretty good chance of being able to figure out how to move my private key to another machine and use it with another browser, so I wouldn't worry too much.

Re:Even worse...

[margretli]

Hahahhaha!! This scenario reminded me of mine. It was the opposite to what you described. The operator wouldn't tell me if my answer was right until I explicitly said "_____ that is the answer to my security question".

Re:Even worse...

[eugene ts wong]

I'd hate to be in that situation.

Re:Even worse...

[Anonymous Coward]

You may know the answer. But it may be case sensitive, and fairly picky. "Whats your favorite food". Is it Curry, curry, curry chicken, Curry Chicken, chicken, Chicken?

My favorite food was Curried Chicken when I initially set up the account info five years ago.

Two years ago, I was introduced to Pad Thai.

Five years from now, when I get locked out of my account and actually have to use said password reminder, how am I supposed to remember what the correct answer was?

It's best to stick with answers that are not prone to changing.

Re:Even worse...

[Anonymous Coward]

Your hourly wage is not a direct indication of how much you value time.

At best, it indicates that you don't value *certain* hours less than having a certain amount of money. Just because I make $40/hour and work 40 hours a week, does not imply I'd be willing to work 50 hours a week for $40/hour. Certain hours are more valuable to me, and the marginal value of hours would obviously increase as I add more hours to my work schedule.

In fact, what I've already said isn't strictly true; it's quite possible that there are hours that I actually _do_ work that I value more than my hourly wage, but I put up with it because I'm faced with the choice, generally, of either 40 hours or 0 hours. In other words, my preferences might running something like 35 hours > 40 hours > 0 hours.

Moreover, it can go the opposite direction, too; just because I'm paid $40 an hour to do something, doesn't mean that I wouldn't give up that hour for less money.

FINALLY, the marginal value of money is not constant. If someone had $100,000 and you offered to flip a coin, heads they get $100,000, tails they lose $75,000, it's obviously a gamble with positive expectation purely in terms of money, but of course it's perfectly rational to prefer certainly having $100,000 to maybe having $200,000 or maybe having $25,000. Likewise, the risk of getting your bank account cleaned out might be worse than mere statistical expectation would suggest.

Re:Even worse...

[mtairhead]

shoot, man...welcome to stats.... >.> Nebu's right.

Re:Even worse...

[DiamondMX]

This gives a system where a brute force attack as a somewhat pathetic 2^8 attempts.

That's significantly less secure than picking a 2 letter password.

Re:Even worse...

[Nushio]

I got an email from slashdot today saying someone requested to change my password...

To whoever tried... I dont really use rot13, its actually rot26!

Re:Even worse...

[Anonymous Coward]

when the use of a "posword recovery question" is mandetory, I always type some random letters. I won't remember it, but at least it's secure.

Re:Even worse...

[Thinboy00]

From just about any Terms of Use:

...You are solely responsible for maintaining the security of your password...

on websites like Yahoo! and Google. If they do that, imagine what your bank does...

HA!

[Dice]

Fooled them. My first car was a Chevy!

Re:HA!

[CaptainPatent]

Fooled them. My first car was a Chevy!

*database updated*

Re:HA!

[RancidMilk]

Too bad they generally get three guesses.

Re:HA!

[JackieBrown]

Now which bank do you use?

Re:HA!

[clang_jangle]

Me too, mine was a 1956 Studebaker -- sure wish I'd kept it...

Re:HA!

[evanbd]

Mine was a Ford'); DROP TABLE Cars;--.

Re:HA!

[Anonymous Coward]

What if you put in that your first car was a Fnord? That could make the entire password reset process invisible to most users.

Re:HA!

[Anonymous Coward]

Fooled them. My first car was a Chevy!

*database updated*

Please place your finger on the biometric scanner to continue.... your identification profile is now complete.

*Updating database*

Well

[Anonymous Coward]

I came up with a standard set of bullshit 10 years ago. I use it to this day. By the way, my first pet was named cfeadr3.

Re:Well

[RulerOf]

It's worse that many places frequently ask you to answer questions that may not apply to you (e.g. what is your spouse's name) or ones with changing answers (your favorite song/movie).

My uncle mentioned that he knew someone who picks a word and answers them all the same way:

What is your mother's maiden name?

blue

What was the name of the high school you graduated from?

blue

What is your favorite color?

blue

...ad infinitum.

Re:Well

[Anonymous Coward]

SUCKER!

I just hacked into your account!

Hey everyone! I'm Anonymous Coward and I'm a dickhead!

Re:Well

[AvitarX]

They caught on, you can't do that anymore.

Preferences are stable?

[CorporateSuit]

Bridgekeeper: Stop. What is your name?
Galahad: Sir Galahad of Camelot.
Bridgekeeper: What is your quest?
Galahad: I seek the Grail.
Bridgekeeper: What is your favourite colour?
Galahad: Blue. No, yel...

Re:Preferences are stable?

[Perf]

Bridgekeeper: Stop. Who are you?
Politician: Defender of the public, famous war hero, community organ grinder...
Bridgekeeper: What is your quest?
Politician: I seek the Presidency.
Bridgekeeper: What is your personal stance on illegal immigration, foreign policy, abortion, the war on terror, etc.?
Politician: Uhmmmm... It's very wide. Let me check the polls.

Re:Preferences are stable?

[jonaskoelker]

Truth is, preferences are *not* stable; my tastes in music have changed over the last ten years. I recall answering a "what's your favorite band" question to get my password, and I had to think back and guess who I was a fanboy of at the time I decided what the answer should be.

Adding to that, preferences are not particularly secret. Here's the pepsi challenge: I'm male, I read slashdot. Use that to figure out which eight of these I like, and which eight I dislike:

Video games, Casino gambling, Fashion, Watching figure skating, Reality shows, Skating, Going to libraries, Playing golf, Heavy Metal music, Reading comics, Going to bookstores, Gaming, Cats, Documentaries, Watching golf, Watching bowling.

I haven't chosen any of them to be easy to guess, just some preferences I feel I could remember. Note also that there's [16 choose 8] possible answers, or 16!/8!/8! = 12870. That's less than 14 bits of randomness; choices are highly likely to be non-uniform and non-independent, so expect less than 14 bits.

Here's some of my likes that are "obvious" from my reading Slashdot: [Video games, Going to libraries, Reading comics, Going to bookstores, Gaming, Documentaries]. Now you only have to find the remaining two likes, among ten options. Note that 10 choose 2 is 10!/8!/2! = 45. Say after three wrongs you're locked out for an hour. Ooh, it's going to take a whole fiften hours to crack me and steal all my monies. (OMG monies).

Even if you disagree on what's obvious about my likes, it seems like you could order them from most to least likely and my fellow slashdotters would still be _roughly_ in agreement. Try all combinations of likes and dislikes from most to least likely; there's your cracking algorithm.

(the remaining ones are cats and heavy metal)

Re:Preferences are stable?

[Anonymous Coward]

Bridgekeeper: What... is the air-speed velocity of an unladen swallow?
King Arthur: What do you mean? An African or European swallow?
Bridgekeeper: Huh? I... I don't know that.
[he is thrown over]

Re:Preferences are stable?

[yali]

Interesting point. The linked site doesn't say much about its algorithm. But I'm guessing that it uses some sort of probabilistic matching of your rankings across many preferences, rather than an exact match. After all, they say right on the sight that you shouldn't worry about remembering things exactly. So I bet your preferences don't all have to be perfectly stable for it to work. Rather, enough of your preferences have to be just stable enough for whatever probability threshold they use.

As for guessing preferences from known behaviors like reading slashdot, I bet the predictability is lower than you'd think. Do all slashdot readers like video games? More so than non-slashdot readers? On average maybe so, but I bet there is huge variance in both groups. Additionally, if they ask about multiple preferences that have low joint probabilities, they can make the algorithm more secure. Knowing that you're a slashdot reader may help me guess that you are slightly more likely than the average person to like videogames, but it won't give me much traction on something like your favorite foods.*

* - Assuming they leave Cheetos and Mountain Dew off the list.

Re:Preferences are stable?

[Thinboy00]

AFAICT from their links, you need 70% accuracy, and they say it leads to a ~0% false negative rate.

pff

[Kingrames]

In most cases being able to reset password with a question like "what's your mother's maiden name?" is worse than making your password "12345".

Re:pff

[OECD]

Especially for those who have their mother's maiden name as either a middle name or part of a hyphenated last name.

Re:pff

[jgtg32a]

My mother's maiden name was 12345

Re:pff

[Anonymous Coward]

...you insensitive clod?

Re:pff

[Anonymous Coward]

Hey! That's the same combination on my luggage!

Re:pff

[sconeu]

My mother's maiden name was #$@DD$#$21

Re:pff

[iocat]

Mine was "Password." It's horrible.

Seriously, I do reuse passwords -- I use the same pw for low-security sites (message boards, excluding slashdot), but increasingly obscure unique ones for more highly secure sites and uses.

My favorite pw creation scheme is to take a sentence that's easy to remember a la "I grew up in Boston, Mass, 02120," from which I derive IgUiBm)2!2), which is a fairly secure pw -- it's easier to remember a sentence than it is single complex word (at least for me).

Re:pff

[Anonymous Coward]

Which is why you answer the question of "What is your mother's maiden name?" with "12345"

Don't use the expected answers. As long as YOU know what answer you use to that kind of question its ok not to use the truth.

Re:pff

[kesuki]

unless you lie, and use a fictitious name like 'frodo baggins' i noticed years ago that the 'security' question was inherently insecure, so i started using false answers only i would remember. try to steal my account by researching my first pets name, you won't get it right hah! this can bite people who can't remember what they used though, i like that some sites now have 'put in your own question' now. makes it easier.

Re:pff

[Anonymous Coward]

Best place to get wings?
Purple Lawnmowers
Very Secure

Re:pff

[John Hasler]

> ...this can bite people who can't remember what they used though...

There is a simple solution to that" Write it down (I know: heresy!)

Re:pff

[punterjoe]

I'm with you. As far as these security bots are concerned, my mother's maiden name was sodoff. I imagine people just think she was Russian & not that I'm cursing at the stupid question. :D

Re:pff

[cortesoft]

If you are able to remember random fake answers to questions, then you probably aren't going to be the type who needs to reset your password. Resetting your password is only something that matters if you have trouble remembering random secure things anyway. You basically just have two passwords now, either of which can open your account (which may or may not be all you are looking for).

Re:pff

[CaptainPatent]

My mother's maiden name was 12345

ahh, then you must be C3PO!

Re:pff

[Anonymous Coward]

Frodo Baggins is fictitious! OMG!

Re:pff

[fishbowl]

>In most cases being able to reset password with a question like "what's your mother's maiden name?" is worse than making your password "12345".

For a really large number of people, the mother's maiden name IS their name.

Re:pff

[BigDaddyOttawa]

Especially if your mom is the one trying to "hack" in to your bank account.

Re:pff

[Anonymous Coward]

Are you sure that wasn't just something she said shortly after getting married?

Re:pff

[Anonymous Coward]

That's amazing! I bet she has a face like my luggage though.

Re:pff

[Reivec]

I actually always use a standard response to these questions that has nothing to do with the question at all. It is basically just another password that I use as a backup if I can't recall the real one. I have never had an issue where I couldn't recall my password. However my bank's website likes to randomly ask me security questions when I login, which is about the only time I have had to use it.

Re:pff

[Anonymous Coward]

i use the same password for everything :( and it's not even that hard, it's my last name plus my birthday. :(

Re:pff

[Darkness404]

Yes, but if MrBlackHat474 wants to access your bank account, he can't pop onto your Myspace/Blog/Company Website/state's public records and get what he needs to compromise your account.

Re:pff

[Anonymous Coward]

That's the same combination of my luggage!

Re:pff

[prockcore]

i like that some sites now have 'put in your own question' now.

I always choose a racy question just so anyone trying to hack my account will get a laugh.

Like "What are you wearing?"

Re:pff

[CastrTroy]

A friend of mine used to generate passwords by coming up with a work, and interleaving it with a number. So, let's say you have the word house, and the number 12345, which are both brutually easy to guess passwords, and when you combine them you get h1o2u3s4e5. Which would probably be a pretty secure password. Mix in a couple of shift keys, and you end up with h1O@u3S$e5, which is probably even less likely to be broken by any dictionary attach. Now in reality you would choose words and numbers that are even less common, so you'd end up with a really secure password. The really nice thing about this trick, is that, in most GUI based logins, you can just type the word part of your password (house), and then move the cursor back to the second character, and type each character from the number, followed by pressing the right arrow key. So you actually get a nice password, that's easy to remember, and easy to type.

Re:pff

[B3ryllium]

Amazing! That's the same combination for my mother!

Re:pff

[Anonymous Coward]

damn it... not again... I have to change the combination on my luggage!

Re:pff

[CastrTroy]

You got modded funny, but I once heard about some study, which may or may not have been real, but it suits this story well, that, if you are the victim of identity theft, that it is very likely to be from somebody you know. So, if anybody you know could answer these questions about you, and the people who have their accounts broken into are likely to be people you know, then it makes the questions practically meaningless.

Re:pff

[maxume]

Or put it in a password database like passwordsafe or keepass. This has the advantage that you can make copies and not worry a great deal about where they end up (Of course, don't email it to your nemesis, but copying the file to a CD isn't anything to worry about).

Re:pff

[Anonymous Coward]

It's funny you say that, because my planet's force field has the same combination!

Re:pff

[Anonymous Coward]

My mother's maiden name was 12345

My mother's maiden name was Robert'); DROP TABLE Customer;

Re:pff

[ksd1337]

Pfft. I just list all my account details for websites in a CSV file, then upload it to BitTorrent as "18 yr old bj porn xxx strip". That way, I'll always be able to download it.

Re:pff

[Anonymous Coward]

"So the combination is 12345? That's the stupidest password I've ever heard in my life! The kind of thing an idiot would have on his luggage!"

Re:pff

[Anonymous Coward]

That's the same combination I have on my luggage!

Re:pff

[Catil]

Seriously, I do reuse passwords -- I use the same pw for low-security sites (message boards, excluding slashdot)[...]

Why do you exclude Slashdot? People don't gain anything compromising your account here. I use the same pw on all sites...

Re:pff

[Catil]

HAHAHA Disregard that, I SUCK COCKS.

Re:pff

[Zironic]

Wouldn't that table he heavily referenced? If you really want to cause damange you're meant to do CASCADE ;)

Re:pff

[miro f]

I usually use a secret question that refers to an "in joke" or event that happened with one other person. Then (since usually you have to answer two questions), my second question just has to be some part of my history that they don't know, and I have a secure secret question/answer that I never forget.

Re:pff

[Anonymous Coward]

Your mother's maiden name is the combination on my luggage! Amazing!

Re:pff

[Tejin]

12345? Amazing, I've got the same combination on my luggage!

Re:pff

[Nebu]

I just list all my account details for websites in a CSV file, then upload it to BitTorrent as "18 yr old bj porn xxx strip". That way, I'll always be able to download it.

Oh, thanks a lot, jerk. I wasted 40 hours looking for the codec that would play that file.

Those are all dumb and easy cracks

[Average_Joe_Sixpack]

I just use the current month and then the year.

Re:Those are all dumb and easy cracks

[Anonymous Coward]

Interesting how this was modded as "funny", because my father does this for all his passwords...

Re:Those are all dumb and easy cracks

[Anonymous Coward]

Too many places make me change my password every three months, so I use season and year.

My passwords at places that don't make me change it are *way* more secure.

Re:Those are all dumb and easy cracks

[Anonymous Coward]

"My passwords at places that don't make me change it are *way* more secure."

Yes. Yes! What is the fucking point of having to change passwords every x months? Oh, the bad guy can't do *too* much damage in only a month...

123

[Anonymous Coward]

This is what usually happens

Although some people I work with write all of their passwords down and keep it under their keyboard or in their desk.

My password

[Anonymous Coward]

Only changes 1 character everytime.

1LuvMyDog!
1LuvMyDog@
1LuvMyDog#...

Re:My password

[JackieBrown]

That how I am at work. I used to have intricate passwords but coming up with a new one every 90 days got tedious real fast.

And Lord help me if I changed my password on a Friday because by Monday I would have no idea what my clever password was.

Re:My password

[tchuladdiass]

Just write your clever password on your whiteboard. Then erase it. You should still be able to make it out from the residue left behind, at least for a few days until it is committed to memory.

Re:My password

[JackieBrown]

Most people I know, write it on a note that they leave in their desk.

Re:My password

[uncqual]

Until the helpful cleaning crew cleans your whiteboard with whiteboard cleaner - somewhere I worked, that actually happened if your whiteboard was "empty" (i.e., had been erased).

Re:My password

[Alpha830RulZ]

I get around that through a pretty intricate password that has enough numerals in it to get around the difference filter. Eg. "23r()Boat$23" (23rowboats23). When the prompt comes up, I change 23 to 24 or whatever, write 24 on a sticky, and I'm good. This let's me figure out what the password is on the myriad of accounts I have to maintain, just by counting backwards. The root password is quite robust, and would be good without changing, but they won't let me get away with that on the email/domain server.

On our mainframe, which is the ultra double secure platform for us, the custom access control system requires exactly eight characters, which can only be numbers and A-Z, uppercase. Which is nice.

Re:My password

[compro01]

Write it down on a sticky note or other handy piece of paper and store it in your wallet until you've memorized the new password.

Re:My password

[miro f]

I've taken to using unix commands as passwords at places that force me to change my password every 28 (!) days.

ls -al | grep FOO
du /BAR | sort -n

etc. The system thinks they're secure, they won't get hit by a dictionary attack, and everyone comments on the size of my password ;)

real information

[Iamthecheese]

People actually enter their real information? I just put a password that I know well.

Re:real information

[skiingyac]

My mother's maiden name is Smith, of all things. That is certainly NOT what I ever put down on anything since I too realized long ago this wasn't secure. But, the design of those questions definitely does encourage you to pick the simplest question and the simplest answer, which is what the vast majority of people will (continue to) do.

I NEVER use these fields

[maraist]

For every web site that asks for a password I randomly generate one.

If they have the audacity to ask for personal information, I randomly generate that data too. What frustrates me is that now I have to store a series of name-value pairs - because some of these web sites insist on randomly asking me to confirm my identity on occasion with these profile questions.

What frustrates me even more is that most people are stupid enough to give random / anonymous web sites such personal info.. What if one of the questions was 'what is your VIN? What's your SSN'??? Would people ignorantly post that data too??

If the website requires a credit card, use this information for credentialling. If it's a community web site, use email responses - if the email is hijacked, the owner should be able to see the flood of change-password emails. I never understood the value-add of such personal-info bio-metric questions.

My bank uses a PIN in additional to the login. This actually makes sense to me - as PINs are generally easier to remember than my 10 digits random char-lists, but moreover it's at least honest about the purpose of these extra fields - and doesn't dupe people into leaving their pants down when the DB gets hacked one day.

Re:I NEVER use these fields

[LighterShadeOfBlack]

My bank uses a PIN in additional to the login. This actually makes sense to me - as PINs are generally easier to remember than my 10 digits random char-lists, but moreover it's at least honest about the purpose of these extra fields - and doesn't dupe people into leaving their pants down when the DB gets hacked one day.

So you think someone is going to hack the login database for a bank and is going to be focusing on the fact that your first pet's name was Mittens?

Re:I NEVER use these fields

[strabes]

Just a question: How do you keep track of all the different passwords of all the different websites which you sign into?

Re:I NEVER use these fields

[ednopantz]

How do you keep track of all the different passwords of all the different websites which you sign into?

Use keypass or another key storage system.

Now, if it had an automagical firefox plugin that would let me create a strong password for a site and store it in my key database, that would rock.

Re:I NEVER use these fields

[jcgf]

He uses post-it notes stuck to his monitor.

Re:I NEVER use these fields

[Anonymous Coward]

Keepass

Re:I NEVER use these fields

[slart42]

For every web site that asks for a password I randomly generate one.

If they have the audacity to ask for personal information, I randomly generate that data too.

Reminds me of the Apple Developer Connection website. When i signed up I just typed "this is stupid" into all the fields because I didn't feel like giving them any personal information (including street address, etc). This came back to embarass me later, though, as Apple at one point called me to give me a free ticket to WWDC, but they asked me to look into my ADC account, because some information there "didn't seem to be quite correct" :)

Re:I NEVER use these fields

[failedlogic]

Forget that. There are many rewards points cards (frequentl flyer, grocery stores) etc. that ask for your mother's maiden name. I always fill out a fake one. If my card gets lots, it better to lose the few points I get than to give them right info I remember.

Re:I NEVER use these fields

[Prien715]

I use them all the time. And I fill them out with information of a fictional character.

Say, I'll put my name as Bilbo Baggains (actually using Brado Bompkins or something similar) and my hometown as "The Shire" and "bacon" as my favorite food. This lets me use unique information and track it. So if a site emails me and says "Hey Bilbo, you just won a new car!" I can tell you who exactly sold my email address.

Re:I NEVER use these fields

[base3]

If the fact that his first pet's name was Mittens is potentially the key to a bunch of other sets of credentials is understood by the perp, then yes. These are metapasswords that are commonly used across scads of websites and would be very useful information for someone wishing to use a usurped identity.

Re:I NEVER use these fields

[strabes]

Come on, let's get real. That won't stop the NSA.

Re:I NEVER use these fields

[maraist]

Huh? I'm talking about the hundreds of public web sites that ask the same questions as my bank does. And if THEY are hacked (or have disgruntled managers), people can brute-force my bank with the forgot-password link's profile-info.

My comment about the PIN is that it stands the reason I'm not going to reuse a bank PIN on some public web site, so such an attack is not as useful or even possible.

Re:I NEVER use these fields

[maraist]

ssh to a central trusted system with a custom encryption solution such that viruses would not be able to generically detect useful info. I don't trust traditional keystore systems because:
A) I don't know if there are government back doors
B) well crafted attacks can search for them like viruses that search for quicken files, or root-kits that replace specific binaries)
C) You can lose your portable USB stick and any hacker worth his salt would run crack on any encrypted files found on such devices.

This does mean that if the central system looses internet connectivity or power, I'm restricted to whatever my remote browsers stored-passwords have cached. But this has rarely been a problem in the past 10 years, and almost never been critical.

Re:I NEVER use these fields

[maraist]

Oh, an addendum. Government backdoors are bad NOT because the NSA is snooping, but because the idiots that designed them probably left the keys somewhere where the Russian mafia can find it. So now the people that I most want to keep away from my private data are tunneling through US government backdoors - way to protect and server bozos!

I'm not joking about this, Eastern European hackers are very well practiced, and the Eastern Mafia are very well organized. Or at least that's why I mumble to myself repeatedly when I put on my tin-hat. Kidding aside, I had several room-mates in college from other countries, of varying degrees of repute, and these were the war-stories passed over a couple too many beers.

Re:I NEVER use these fields

[John Hasler]

Which, in many circumstances, is an entirely reasonable thing to do. In others that might not be safe but it would be ok to write the passwords down and put them in your wallet. It depends on the threat model.

Re:I NEVER use these fields

[Anonymous Coward]

Reminds me of the Apple Developer Connection website. When i signed up I just typed "this is stupid" into all the fields because I didn't feel like giving them any personal information (including street address, etc). This came back to embarass me later, though, as Apple at one point called me to give me a free ticket to WWDC, but they asked me to look into my ADC account, because some information there "didn't seem to be quite correct" :)

Did you change them by appending " and insecure" to all of them?

Re:I NEVER use these fields

[ParanoiaBOTS]

My bank uses a PIN in additional to the login. This actually makes sense to me - as PINs are generally easier to remember than my 10 digits random char-lists.

Granted adding a PIN number does increase your security. While I see the security flaw of standardized security questions, what makes people think that their PIN is secure? I mean seriously its a 4-10 Digit NUMBER. Now how long exactly would it take to crack? IMO it would be easier to put a fake reader onto a ATM so that you get the magnetic data, and then after that the rest is fairly trivial. We have a lot more security issues than most people seem to realize.

Re:I NEVER use these fields

[LighterShadeOfBlack]

I can see how that would be a problem, but your first post doesn't read anything like that.

Re:I NEVER use these fields

[capologist]

Sticky notes on the monitor.

Re:I NEVER use these fields

[greenkite71]

PasswordMaker add-on for Firefox. Choose one super-secure master password and generate unique passwords for every site you visit (based on domain name). Awesome.

Re:I NEVER use these fields

[oracle128]

You mean like this? (it's an AutoIt script, not a Firefox plugin, but does what you want)

Re:I NEVER use these fields

[Anonymous Coward]

I do use them, but as a reminder. I just put random data in the fields. That way, when I don't remember one password, the site asks me "what's your favorite color ?" and thanks to this question, I know the class of password I used there.

Re:I NEVER use these fields

[OneSeven]

A custom encryption solution? Ok, but what about those of us who aren't Bruce Schneier?

I don't have any affiliation with the software/devs other than being a long-time user and occasional bug-reporter, but KeePass:
A) Is GPL. Haven't been through the source myself, but I find it highly unlikely that a 'government back door' would go unnoticed.
B) huh..?? Don't really follow what you're getting at here.
C) Have KeePass generate a key-file for you, which you then need to use along with the password for two-factor auth. (obviously don't keep the key file with the password DB!). Layer on more levels of encrytion by putting the password store inside a TrueCrypt volume (hidden volume if you want to go with deniability as well), etc, etc.

On top of that, KeePass has some pretty nifty features like auto-type w/ obfuscation that (claims to) break all known keyloggers and clipboard spies, in-memory encryption so your passwords will never show up un-encryted in a page file, and configurable key-transformations to slow dictionay attacks to name a few. I personally trust it more than I trust an encrypted network connection and use it for everything these days. Seriously, check out their security page.

Unfortunately it's for Windows only, although there is a cross-platform port called KeePassX (haven't tried it yet myself).

Re:I NEVER use these fields

[Morty]

I randomly generate passwords and the answers to the "personal" questions, and then PGP email them to myself. The PGP email includes the name of the site and the date that the password is effective. If I have to change a password, I send myself a new email but include in it the old password(s), along with the date they were effective, in the body. I started tracking "old" passwords as well because I found that sometimes, I needed to resurrect an old, decommissioned system from years ago, and it's really handy to have all the possible passwords for it in one place.

The way I figure it, encrypted email is a "solved" problem, so why not leverage the existing infrastructure?

Re:I NEVER use these fields

[mpe]

Government backdoors are bad NOT because the NSA is snooping, but because the idiots that designed them probably left the keys somewhere where the Russian mafia can find it.

You should probably consider yourself lucky if it's only the Russian Mafia who can get their hands on them.

Re:I NEVER use these fields

[Anonymous Coward]

Multiplatform: www.keepassx.org
Gnome (with panel applet): Revelation

You know there are good tools for this...

Re:I NEVER use these fields

[houghi]

And that is important to you because ...
I just use my spambox houghi.spam@gmail.com for most websites. They can sell that adress as much as they like. Only when I need something (like a confirmation to enter the site) I look in that mailbox. All the rest is deleted unread.

I used to use a different login and email for each adress (e.g. example.com@some.example.net) and it just made it more difficult for me, while not reducing my spam.

Re:I NEVER use these fields

[Zironic]

It would take forever due to the fact it gets disabled after 3 failures. Most people that put up the fake readers also put up a small camera so they get the pins.

Re:I NEVER use these fields

[Anonymous Coward]

PasswordMaker?
clipperz.com ?

Re:I NEVER use these fields

[RMH101]

this is what Mac Keychain does if you use Safari or Camino as your browser. Just sayin'

Re:I NEVER use these fields

[Anonymous Coward]

What frustrates me even more is that most people are stupid enough to give random / anonymous web sites such personal info.. What if one of the questions was 'what is your VIN? What's your SSN'??? Would people ignorantly post that data too??

I think you will find the answer is yes.

If the website requires a credit card, use this information for credentialling. If it's a community web site, use email responses - if the email is hijacked, the owner should be able to see the flood of change-password emails. I never understood the value-add of such personal-info bio-metric questions.

1) Hijack account. 2) Change email associated with it. 3) Change password on the account. 4) Total lockout to previous account holder achieved.

Re:I NEVER use these fields

[tlacuache]

I keep a tiny TrueCrypt volume which contains a text file with my login credentials for the various websites I frequent. Usually I can remember the username/password for all the sites I visit, but if I forget I can mount the TrueCrypt volume and look it up, and I don't have to worry about the file falling into the wrong hands.

Re:I NEVER use these fields

[Anonymous Coward]

Damnit, what did you hack to figure out my first pets name was "Mittens"?!?!?

Re:I NEVER use these fields

[Anonymous Coward]

Bad idea. A text file might be swapped out to virtual memory on your normal (non-TrueCrypt) volume which means that a scan of the swap file could reveal all your passwords at once.

Better off using something like KeePass which has its own encrypted DB. Even if you use the clipboard functionality to copy and paste a password out and it gets swapped, it won't be in context of sitename/username/password and will be just one piece of random data in the cache file.

Re:I NEVER use these fields

[Anonymous Coward]

You missed the point. You can already look up much of the data online.
But your personal preferences can be used AND sold. Now that's real value.

And we'll give them away freely. Think of all the quizzes and polls online,
people love taking them, without thinking their data is now recorded forever.

"You online choice was Bush in 1999." Maybe because he said he'd bring respect
back to the Presidency? (BTW, talk about a flip-flopper changing positions!)

"In 2004, your online choice was John Kerry."

Re:I NEVER use these fields

[pjt33]

If the website requires a credit card, use this information for credentialling.

I don't know about your credit card, but mine has a habit of expiring every few years. Besides which, very few sites should actually store credit card data. The majority should route you through someone like Worldpay and never even see your credit card details, because there's less impact on you from their inability to secure their database properly.

Re:I NEVER use these fields

[j-cloth]

I wouldn't count on people not reusing bank PINs though... we recently introduced a keypad lock system on the office doors and we had to start assigning random door codes once we realized that everyone was just giving us their PIN numbers to program into it.

Re:I NEVER use these fields

[Anonymous Coward]

I use Gmail so when I give out my email address I'll give it out as say myemailaddress+cokepromotion@gmail.com. This helps me in about the same way as you providing a false name. Guess I never thought about doing that.

Re:I NEVER use these fields

[Anonymous Coward]

Just a question: How do you keep track of all the different passwords of all the different websites which you sign into?

About 1.5 years ago I discovered Password Gorilla (http://www.fpx.de/fp/Software/Gorilla/) and have been using it ever since to store unique, random, passwords for every login account I've got. It's amazing how many I have stored in it now. It also includes a built in random password generator (you pick the length/type, it generates the PW) and interfaces with the clipboard so that you can "paste" passwords directly from PWGorilla into password input boxes on web pages without having to manually copy them over.

Re:I NEVER use these fields

[Anonymous Coward]

I randomly generate passwords and the answers to the "personal" questions, and then PGP email them to myself. The PGP email includes the name of the site and the date that the password is effective. If I have to change a password, I send myself a new email but include in it the old password(s), along with the date they were effective, in the body.

Sounds like a major pain in the ass to me. You must have lots of free time.

Re:I NEVER use these fields

[RemyBR]

Ever tried the Ironkey?

Re:I NEVER use these fields

[Anonymous Coward]

Ever heard of password managers ?

Re:I NEVER use these fields

[Anonymous Coward]

At one point, I used the same password everywhere just because I couldn't be arsed to remember dozens of passwords. After one of those web sites got hacked I decided to stop that and started using a random password generator. Then I copy the user/pass into a text file and encrypt it with GPGP.

THAT password I can at least remember, it is long as hell and, even if I explained exactly what it's based on, someone would be more likely to guess it completely at random than they would based on the explanation.

OT: The captcha for this reply is 'distort'. That amuses me.

Re:I NEVER use these fields

[Anonymous Coward]

Use the PASSWORDMAKER add-on with Firefox.

Providing you can remember one master password plus the starting parameters (type of hash, number of characters etc.) it repeatedly generates a random appearing password for each site.

There's also the portable desktop version for travelling or for use with other browsers.

Re:I NEVER use these fields

[Geoff-with-a-G]

I knew a guy who did a similar trick, but with his middle initial. Since it was still his real first and last name, he could use it for serious things like credit card applications or school registration, and few bothered to actually verify the middle initial, they just store it.

So if he started getting spam (physical, not email) addressed to John C. Doe, he knew that Citibank had shared his address. If it was John A. Doe, then it was Amazon. John S. Doe was his school, etc.

Neat trick, but I never really attempted it. I'm cynical enough to suspect that some law somewhere makes it a capital crime to give "fraudulent personal information in a financial transaction" or somesuch...

Re:I NEVER use these fields

[maraist]

But if you have a premium credit card service, then you have access to credit-card credentialing / validation; billing-address info, etc.

Re:I NEVER use these fields

[Anonymous Coward]

PasswordSafe (google it)

Re:I NEVER use these fields

[Anonymous Coward]

Here are two: Roboform - www.roboform.com (this is what I use, but is not free) and KeePass - http://keepass.info/ (this is free)

Re:I NEVER use these fields

[AbRASiON]

I have to sadly admit in my case, a google documents spreadsheet - there must be over 400 email / password / usernames in there. (EACH)

Re:I NEVER use these fields

[Anonymous Coward]

1) keep randomly assigned password

2) [secreteword]@[sitename]
eg. "mypassword@slashdot.com"
Its long, easy to remember and unique for each site

3) place all usernames, passwords, shareware license key etc. in Password Corral freeware

Encrypted export backed up to external drive and S# drive nightly.

Re:I NEVER use these fields

[maraist]

How does knowing my mother's maiden name help anybody, if it is never used by me for biometric profiling? I'm not talking about only giving my real info to banks, I'm talking about lieing to banks as well.

So far, the only obsticle I've run across are services that do credit-history lookups - they'll give multiple-choice from random items in that list.. I agree that THAT info is googleable and thus completely insecure.. Only way to avoid that is to sue those type of companies.

Re:I NEVER use these fields

[Anonymous Coward]

Look at the underside of his keyboard...

Re:I NEVER use these fields

[Anonymous Coward]

For one site i made the answer to the questions the questions themselves. For other sites I will make up random stuff or use variations of the questions for the answers.

For storing and remembering passwords, I use an encrypted file to keep all passwords. If your confident a plain text HERE_ARE_MY_PASSWORDS.TXT file is secure on your computer that will work just as well and its one less password you have to remember.

If you really want to track who is giving your email address away, get your own domain and for each site you need to submit an email, use that site name for the account name. So for slashdot you would use slashdot@yourdomain. If the email address starts getting slashdotted then just block the emails, delete the account or even better yet automatically forward them to the support, sales, info, abuse and any other email addresses at company that gave out your email address.

I have confronted several companies doing this that claim they don't give out email and had no idea what to say when I forwarded them a hundred spam emails that are addressed to the name of their company @mydomain. My response to them is if you did not give it out then you have been hacked.

Re:I NEVER use these fields

[Dice]

We have a similar problem at work, since we do sysadmin for a number of companies. All passwords for a given client are stored in a PGP encrypted file which is version controlled under CVS with some custom wrapper scripts. Anyone who has access to that client has their public key included when building new PGP files so that they can decrypt the file at will in order to retrieve any passwords they might need.

Re:I NEVER use these fields

[Anonymous Coward]

Pointless today.

Your email is used in spam sent by anonymous proxies. You'd have more luck tracking my Aunt Lucy's lost dog with a buss pass than getting your uppance with the seller of your precious email address.

My Precious!

Password reminder hints problems

[hack slash]

I recently bought a domain+hosting space from a well known site, one that I don't ever recall buying domains from in the past (even searched through years worth of emails - nothing), and when signing up for a new account I was unexpectedly greeted with "that email address is already in use".

So I did went to the password retreival page, entered in my email address and it asked me the stupidest hint question (for me) ever: "What was the make of your first car?", it didn't make sense at all because I still haven't bought my first car!

Re:Password reminder hints problems

[pig_man1899]

Must be the new generation of cyber-squatting. You no longer have to rush to register all the interesting domain names if you have accounts using all possible email addresses ;-)

'Other' Questions

[Zekasu]

Many websites allow you to use your own question, rather than a preset one. "What is the movie you'd most relate to your high school career?"

"What was the name of craziest teacher you had?"

Better yet, "On Tuesday mornings, which newspaper did you always use to cut out little robot people?"

Re:'Other' Questions

[quintessentialk]

Or, "Where did you bury the body of your eleventh victim?"

Re:'Other' Questions

[Anonymous Coward]

I tried to use this feature on one site, and it didn't work. For some reason it refused to accept "Paper, Scissors, or Rock?" as a question. (My answer would have been TnT.)

Re:'Other' Questions

[Anonymous Coward]

Even easier, make the question be something like what was the password for the sunos 4.1.3 box in your first summer job?

Nobody would have any clue. It should be a strong password and hopefully something you'd remember.

What I really hate are the systems that require 'strong' passwords with strange rules. Your password must contain all lower case letters, begin with a letter, contain at least 1 number but not at the end and one of the following symbols ^()=-

WTF, why can't I use mixed case any symbols I want and put them wherever I want in the password? It was some utility company and every time I logged into their site I had to reset the password. Of the 32 commonly typed non-alphanumeric symbols, their limited set was just too limited for me to remember.

Re:'Other' Questions

[uncqual]

Oh yes, it's easy to remember now... Just wait until you're working on your second hundred victims.

Re:'Other' Questions

[Borg Bucolic]

Someone should make a "good" list of questions to use.

What's the name of the voice in your head?

Where are the bodies buried?

Re:'Other' Questions

[techno-vampire]

If I were allowed to do that, the question would be this: What WAS your username?

The answer, of course would be:

<clickedy-click!>

Re:'Other' Questions

[mr_mischief]

You assume the text entry box has enough space for either of those. You may be making a mistaken assumption.

Re:'Other' Questions

[alnya]

A friend of mine set her question as:

"You're not going out dressed like that are you?"

and her password is:

"You can't talk to me like that, you're not my real dad!"

She says call center staff always crack up

Re:'Other' Questions

[Anonymous Coward]

"Have you stopped beating your wife?"

Re:'Other' Questions

[Borg Bucolic]

You assume the text entry box has enough space for either of those. You may be making a mistaken assumption.

This would actually be better. Location Hoffa's body. Ex's other nickname. (maybe too easy) True father's name.

Re:'Other' Questions

[mr_mischief]

Now you're assuming people know who their real father is, or that their mothers even know.

Re:'Other' Questions

[Borg Bucolic]

Now you're assuming people know who their real father is, or that their mothers even know.

The "Who's your daddy?" question does take on a practical application.

I suppose I could be, "Who's the daddy?"

Edwards could use this one.

Wish I could bypass that step...

[st33med]

Unlike most people, I have an excellent memory of what passwords I use. I often forget what password I set, but, if I input the wrong one, I try another one until I get in...

Seriously, I sometimes put in for a secret answer something that does not correspond with the question being asked. :)

Comment removed

[account_deleted]

Comment removed based on user account deletion

Well, at least's that's a little secure

[davidwr]

It's pretty hard for a virus to read what's beneath the desk. Not impossible if the virus can control your employer's security cameras, but difficult.

Re:Well, at least's that's a little secure

[LighterShadeOfBlack]

It's pretty hard for a virus to read what's beneath the desk. Not impossible if the virus can control your employer's security cameras, but difficult.

If they're under your desk I don't think those are security cameras.

Re:Well, at least's that's a little secure

[ksd1337]

But it's not hard for people to read stickies under your desk.

So true

[Anonymous Coward]

I hate when sites *require* one of these stupid "security" (hah!) questions. It's bullshit. So what I do is that I enter one of a small set of (strong) passwords into that space that I don't use anywhere else, so that on the very improbable chance I don't remember a password for a site, I can use one of those. Or if I don't care enough, I'll just use the same actual password, particularly if it's something not important.

No duh

[Anonymous Coward]

No duh. Who in their right mind thought having simple secret questions, to reset passwords, as a good idea? Especially when MySpace and the like contain a bunch of information people willingly put up online.

Birthdates aren't secure for password resets since people aren't afraid of letting others know when their birthday is. Like, "Hey, it's my 21st birthday today!" on their social networking blog.

Zip codes aren't secure for password resets either. It's not too hard to find out where someone lives, with a bit of investigating.

Secret question answers might be listed on one's social networking profile.

Just lie!

[xanadu113]

Just lie on these questions! Put in answers you would know, but aren't factually correct.. =)

Simple solution..

Re:Just lie!

[jrumney]

Exactly. It can confuse customer support when they have to confirm your identity though, as they start to think the database is corrupt when the answer on their screen is completely unrelated to the question that they're about to ask you.

Re:Just lie!

[Anonymous Coward]

This is what I do. No matter what the question is, my answer is always the same random 15 char string that I managed to memorize.

Re:Just lie!

[Nebu]

Just lie on these questions! Put in answers you would know, but aren't factually correct.. =)

I have enough trouble remembering the factually correct answers (when the hell is my birthday again?), nevermind the lies.

Re:Just lie!

[Anonymous Coward]

Yeah, and then forget your lie, right?

Re:Just lie!

[teslar]

Yeah, I used to do that all the time. The only issue - every time I needed to actually answer those questions, the only thing I knew for sure was which answer was the wrong one... but I could never remember what I actually put in :)

Re:Just lie!

[Anonymous Coward]

I did this for a yahoo account. Now, I have forgotten the password, all the personal info was bogus, and thus can't log in anymore. There has to be a better way.

Re:Just lie!

[knarfling]

But then you have to remember the lie.

For example, if I was born in Boston, and they ask for my birth city, Did I answer New York, Atlanta, or Tampa? Or did I put in something completely different like Tatooine, Emrald City, or Ceti Alpha 5(6)? Or did I put in nonsense answers like phaser, light sabre, laptop, or even lkuso1iga133662?

Which lie did I tell on this web site, and it is the same lie I told on my banking web site?

Re:Just lie!

[acheron12]

How do you remember whether you used Aunt Mary or Aunt Jane for a particular website?

Re:Just lie!

[BenoitRen]

Personally I just input some gibberish. I find this kind of fail-safe far too risky.

generally used for low-security applications

[bcrowell]

These things are generally used for very low-security applications. My bank doesn't use them, stock trading sites don't use them, etc. And in many cases it would still be hard for a bad guy to take over your account this way. For instance, they may send you an email every time the password recovery feature is used on your account. A well designed site won't actually let you recover your old password, it will generate a link with a hash code in it that allows you to pick a new one; so the bad guy can't find out what your password used to be (which would be especially scary if you were in the habit of using the same password for lots of things), and if it's an account that you use frequently, you'll also find out quickly that something is wrong, because your password will no longer work. And I would guess they also have a limited number of times you can guess your dog's name wrong. But okay, suppose someone manages to get access to my amazon.com account this way. Is it really that horrible? I suppose they can set up a new shipping address, order some CDs, and have them sent there. So I just turn around and call my credit card company, and they reverse all the charges.

The typical slashdot user is really into using high-tech toys in sophisticated ways, but for the average person there really are severe usability issues with maintaining login and password combos, and these "what was your first pet's name" questions are a a not entirely unreasonable attempt to make things easier for that type of user. My mother in law visited us recently for a few weeks. She's had a history of dysfunctional relationships with her Windows machines (viruses, etc.), so I got her started on Linux. Her main application is that she plays an online scrabble game (not the famous facebook one). She'd been unable to use her virus-infested computer for a long time, so it had been a long time since she'd been able to play scrabble. I got her set up on a spare linux box in the family room, and the very first thing she wanted to do was get scrabble working. Well, she just couldn't remember her username and password for this server. Tried a bunch of things, no luck. She was bummed out, too, because she'd had a high rating, and creating a new account with a zero rating meant it would be hard for her to get games. It would have been a lot better, from her point of view, if she'd been able to tell them her dog's name and recover her password. Who the heck cares if it leaves her vulnerable to having her scrabble account taken over by evil Russian hackers with handlebar moustaches?

All of this might seem ridiculously easy to handle to us, but I could easily imagine myself having the same problem 10-15 years ago. It's not obvious to her how her email is nested inside her yahoo account, her yahoo account is inside her browser, and her browser is inside her OS. It's not obvious to her that the username and password she uses on yahoo are different from the ones she uses to log in to her linux account.

Re:generally used for low-security applications

[PCM2]

These things are generally used for very low-security applications. My bank doesn't use them, stock trading sites don't use them, etc.

I have retirement accounts at two different major financial companies and both use these kinds of questions. I know this because I forgot my passwords recently, because their "more secure" password rules wouldn't allow me to use my normal password-generation formula.

Re:generally used for low-security applications

[bcrowell]

These things are generally used for very low-security applications. My bank doesn't use them, stock trading sites don't use them, etc.

I have retirement accounts at two different major financial companies and both use these kinds of questions.

Scary! What other safeguards, if any, did they have in place to keep someone who knew your dog's name from stealing your retirement fund? It's frightening how clueless about security some of these sites are. Ameritrade was infamous for years for leaking email addresses to pump-and-dump scammers, and not only would they not fix the security breach, they wouldn't even admit that it was happening.

I know this because I forgot my passwords recently, because their "more secure" password rules wouldn't allow me to use my normal password-generation formula.

Yeah, that's annoying. My employer has a site I need to use, and they only allow you to use 6-digit numerical passwords. Normally I use software to generate an 8-character base-64 hash for each web site, but I can't use it for their site.

Re:generally used for low-security applications

[Anonymous Coward]

tl;dr: Don't forget your Scrabble password.

Re:generally used for low-security applications

[Anonymous Coward]

Time Warner Cable uses a payment service that doesn't even encrypt your passwords - and will email them out to you when you do a "i forgot my password" click. Talk about low security! I hope you aren't using that pass for anything else!

Re:generally used for low-security applications

[Ihaveseenthefnords]

If I can get into your email address by changing the password, then comb your inbox and saved emails for the word "password", I can change your email password back to your most common password. On top of that, you'd only need a few hours - easily gained by attacking when someone is most likely to be asleep - to compromise far more secure things. Once you have access to the average user's email inbox, you have a list of passwords for other things. It's not the size of the password that counts for security, it's where you store it.

Re:generally used for low-security applications

[halcyon1234]

if it's an account that you use frequently, you'll also find out quickly that something is wrong, because your password will no longer work

This can actually bite you in the butt in certain cases. It used to be a way to abuse eBay. You and JoeScott are bidding on the same item, and it's coming down to the final minutes. You log out, then try to log in as JoeScott. Of course, you don't know his password. That doesn't matter. Just try five times. After that his account is locked out. It's a trivial matter for him to unlock it, but by the time he has, the auction is over, and you've won it without a costly bidding war.

Sure this may have been temporarily solved by not showing the usernames of opposing bidders-- and by bringing the Holy Hammer of Hell down on any IP that matches both "winning bidder" and "losing bidder logging in 10 times in a row"-- but we're a creative bunch and I'm sure we can figure out how to use the Password Recovery feature as a DoS attack.

Re:generally used for low-security applications

[greed]

HSBC Direct Canada bloody uses them. And you're limited to answers LONGER than 8 characters. And you can't have a space.

And all my hobbies have spaces in them OR are shorter than 8 characters, same with car, same with city, same with mother's maiden name, same with school name, and so on.

So I added more "masked" columns to my SpashID entry for that account and filled out more random gibberish.

Re:generally used for low-security applications

[dword]

I suppose they can set up a new shipping address, order some CDs, and have them sent there. So I just turn around and call my credit card company, and they reverse all the charges.
That's with your amazon.com account. Yeah, you can reverse the CC charges in this case. Who the fuck cares about corporate secrets? Who the fuck cares that you have to turn around 3600000 degrees in total when you make hundreds of calls to your CC company to reverse those charges? Who the fuck cares that they used the information they gathered about you from amazon.com to use your identity in countless other places (websites, banks, restaurants, etc)? I'm sure you don't because you seem to lack the brains for that.
If your mother-in-law would have lost her scrabble account because someone stole it as they didn't need to know some secret answer to some stupid question, you'd be divorced by now. It's better not to know all those details and get your account locked than having someone steal it from you. As long as it's locked it's still yours, nobody else uses it to take advantage of your work and guess what?... you can probably recover it by calling customer service. It wold be about a million times easier than recovering money stolen from your bank account which may take up to 10 years, sometimes 20 years and sometimes literally an eternity.


You've clearly never had anything stolen because of lack of security. If your mother-in-law would loose her scrabble account because someone found out her security answer, I bet you'd be complaining about the lack of security even for the most basic websites bla bla bla.
You're always welcome to come here, with us, in the real world.

Too bad this guy wasn't you ...

[Krishnoid]

Exactly how excellent is your memory, then? This kind of corner-case made me reconsider best-practices password security.

FTA

[Sir Holo]

"And very few preferences are recorded in public databases.'"

Yet.

APML

[miruku]

"And very few preferences are recorded in public databases"

Not for long if APML usage kicks off..

Wait a minute...

[PC and Sony Fanboy]

Yes, it is available through public record. But that isn't enough! What if your siblings like to play pranks on you, or if your mother is trying to get you to move out of your basement?

How do I protect myself from THEM?!

Re:Wait a minute...

[tubapro12]

I always go with the 'first pet' route, but unfortunately Catbert seems to hates me now... and he stole my HR job!

Re:Wait a minute...

[darkpixel2k]

No one will ever guess that I just pick a question at random and give all the same answers.

Mother's Maiden Name: lando-calrissian
Favorite pet: lando-calrissian
Year you were born: lando-calrissian
Best friend: lando-calrissian

Guess that, suckers.

Re:Wait a minute...

[MPAB]

I think that's the point. The people most likely to try and read your email are those closest to you. Those that would know for sure the answers to such things as your mother's maiden name, the brand of your first car or the place you grew up in.

The maiden name isn't even a secure option in latin countries where the last names are kept and added upon marriage.

It's pretty probable that most people who now realize this, wrote a sincere answer many years ago whilst creating their account, thus leaving the key on the lock.

Yahoo is perhaps the worst case I've seen of password reset vulnerability as it doesn't let users get to the reset question they once wrote, not even to peek at it and try to remember what it was!

Re:Wait a minute...

[ozbon]

I still say the worst is the "Secured by Visa" and/or "Secured by Mastercard" validation at the moment.

If you can't remember your validation password, you can go to "generate new password", where the security information you need to enter is primarily:

card no
CVV code from back of card
date of birth

And that's about it.

Truly scary.

Re:Wait a minute...

[ozbon]

Simple - just because that's what the form has asked for, it doesn't mean that's the data you have to put in.

Mother's maiden name? "Han solo"
First Pet? "Giraffe"
First car? "Slashdot"

I don't think I've *ever* put in the correct answers to those questions. So long as the answers are known to you, and you remember what you put against what, then what does it matter?

Re:Wait a minute...

[Anonymous Coward]

Of course if you can remember what answers you put why can't you just remember your password?

Re:Wait a minute...

[MPAB]

At least it's not "Verified by VisTa"

Re:Wait a minute...

[donjefe]

Why can't they just ask you for a secret phrase? This could be anything, like: "Zed's dead baby.". Since there is no question, the chance of somebody ever guessing this are nil. Better yet, let's get some PGP key action going so I don't have to remember 2000 frickin passwords.

Re:Wait a minute...

[toleraen]

Not that it makes it any better but I could have sworn I needed my SSN last time I reset that.

Re:Wait a minute...

[Trigun]

I love the ones that allow you to choose your own questions as well. I always pick ones that I know someone in IT would be able to pick, but aren't really from the IT field, per se.

"What is the airspeed velocity of an unlaiden Swallow?"

"Oh fiddle-dee-dee. That will require a ..."

It allows my employers to choose a successor should I pass on, and my brother a chance to clean out all the incriminating evidence from my web presence should he need to.

Re:Wait a minute...

[Anonymous Coward]

Name of first girlfriend: lando-calrissian

Re:Wait a minute...

[orclevegam]

I do the same thing. Far more secure, as it's essentially a "backup" password.

Re:Wait a minute...

[LVSlushdat]

What absolutely blows my flippin' mind is the sites that ask you these questions, and hide the answers you typed with asterisks, as though they were a password. This kinda defeats my cut/pasting the exact answers I used into my local encrypted password store. And of course, after 6 months, you try to login in a hurry to pay your car insurance premium (Yes.. I'm talking about YOU, StateFarm Insurance...), you can't remember *precisely* what you entered 6 months ago, case and everything... so you *have* to call into their offshore callcenter, and wait..wait..wait.. This was a signifcant reason I dumped them, not to mention saving nearly $800/yr with another carrier...

Re:Wait a minute...

[JCSoRocks]

Exactly... who's dumb enough to really put legitimate answers in those boxes? I always use something nearly as strong as my password and it never has anything to do with the question itself... it's basically just another password. This is a security issue like people downloading "smiley face / screensaver packs" and installing them is a security issue. There's a small stupid percent of the population that this is an issue for... and that's it.

Re:Wait a minute...

[Vr6dub]

That is what I usually do except...This one particular site recognized I had put the same answer for all questions and refused to accept them. Argghh.

Re:Wait a minute...

[piers_downunder]

My SO entered bogus info when she signed up for a Yahoo email account many years ago. She never deleted anything from it and had literally thousands of messages in it, some unread, some with financial info, and some with enormous sentimental value (such as email and voicemail from her late brother).

All well and good until the website timed-out when she went to change the password. Suddenly neither the new password nor the old one would work. The only way Yahoo would let her back into her account was if she could answer some of the info she filled in with junk many moons before. She still has no recourse to get back in six months later.

It's all well and good to be paranoid and enter bogus info when you sign up for a free website, but you might want to consider that if you don't store a record of it, you might get locked out of your own account forever.

Re:Wait a minute...

[BigJClark]

I'm almost tempted to try to log into your slashdot account with lando-calrissian

Re:Wait a minute...

[raulrocks]

The irony is that the people on this site reading this article and these comments aren't the ones who need to. We ARE the ones who make up answers to those questions. But the 79% of the population who barely know where the power button is are the ones who NEED to see this article.

Re:Wait a minute...

[darkpixel2k]

I'm almost tempted to try to log into your slashdot account with lando-calrissian

Damnit!
*click* *tap* *click* *type*
C H E W B A C C A
*click*

*whew* Safe again.

Re:Wait a minute...

[RockDoctor]

My SO entered bogus info when she signed up for [...SNIP...] It's all well and good to be paranoid and enter bogus info when you sign up for a free website, but you might want to consider that if you don't store a record of it, you might get locked out of your own account forever.

What you need is something which you've got reasonable confidence in the security of, in which you store your passwords and related information. This is not of course, your general computing device. It's not something that does connect to any network (preferably, it's something that CAN'T connect to a network). Of preference, it's old and ugly and unattractive to thieves. If it performs some other functions of use, this is beneficial too. (Mine is a damned good alarm clock, and allows me to calculate surveys and wellbore trajectory corrections in real time on the rig floor.)
Don't forget backup hardware and backup copies of the important files.
Which reminds me - this is Sunday, so this is Psion backup day.

Oh, and make sure you don't confirm

[Itninja]

I was surprised recently when my back asked for all this type of information (i.e. childhood friend, first school), but didn't have me confirm a single field. There was just a single text field for each question. God help me if I fat-fingered one of the answers. Was my first school All City Elementary...or All City Elemntary? OH CARP!

Re:Oh, and make sure you don't confirm

[Anonymous Coward]

It's bad enough that so many places ask for this information, but when body parts start asking that's where I draw the line. If my back asked me for that information I would tell it to go fsck itself. Isn't the fact that it is a part of me enough proof that I am who I say I am?

Next thing you know, all of your body parts are asking. I need to walk to the fridge, better authenticate with my legs. When was the first time I ever paid for sex? Was it 12 or 13 years ago? OH SALMON!

Re:Oh, and make sure you don't confirm

[maxume]

When your back asks you a question, no matter the question, the proper response is to poke it in the eye.

Re:Oh, and make sure you don't confirm

[slash.duncan]

I had that happen to me once. I typoed a starred box and never did figure out what I had put there. Actually, I think I must have typoed the same thing twice as I believe it DID have a confirm.

That's why every time I get one of those now, I open up a text-editor window or something, where I can see what I'm doing, put it in there, then select it, check klipper's select/copy list to verify it's in there correctly, paste it back into my scratch window to verify I'm pasting what I expect, /then/ paste it directly into the starred box and confirm.

I've not had the problem again.

Re:Oh, and make sure you don't confirm

[nfk]

"I was surprised recently when my back asked for all this type of information"

So that's why those people whip themselves in the back. And all this time I thought they were religious fanatics.

A combination of problems

[Opportunist]

The first and obvious is that those "reminder" pages usually draw from a limited set of possible answers. What's your favorite color? If you're a man, you know about 6 ("peach" is no color, it's a fruit!). So, and this gets us to the second problem, keep trying, they usually also don't have limited amounts of attempts. Yellow, blue, green, red, black, white... you're prone to stumble upon the right one eventually.

The worst reminder question I ever had was "what's the last 4 digits on your credit card?" Besides giving away CC info, you can't even dodge it by entering a bogus answer to throw crackers off (because my favorite color could well be "toast"), you HAVE to choose one of 10,000 possible answers.

Use consistent fakes

[oldspewey]

I have a fake mother's maiden name that I use for online forms (as well as offline forms where I feel the organization in question has no fucking need to know the correct answer). I have a fake first car answer, a fake best friend answer, and a fake city where I was born. I use the same ones consistently for all my password reset questions.

Re:Use consistent fakes

[AJNeufeld]

So once someone has cracked (or an unscrupulous website administrator has stolen) one website's database where your fakes have been stored, they could attempt a breakin of other websites you visit.

Re:Use consistent fakes

[oldspewey]

I suppose they could, but they'd be able to do the same thing if I used consistent "real" information in those fields too ... and at the end of the day I guess I just have to hope that I'm simply not that interesting of a target.

Re:Use consistent fakes

[theskipper]

I sometimes use a fake mother's maiden name also. But as others have noted, the difficulty is knowing when you lied.

The key is to pick a name that makes the CSR chuckle after seeing your answer in the system. Then it's a slam dunk that you used the fake name.

In case you're wondering, I was conceived by Mary Magdalene.

Re:Use consistent fakes

[Von Helmet]

I am not joking when I say that I can't even spell my mother's maiden name. She's Finnish and it's about 12 letters long. I always double up the wrong consonants and get it wrong.

If anyone asks for my mother's maiden name, I give my wife's maiden name.

Only broken if e-mail cracked

[AJNeufeld]

Is this really that much of a security issue? The new password is sent to your registered e-mail address, and only if you log in with the new password will your old password be changed. Otherwise, your password remains unchanged. So, unless the e-mail is sniffed in transit, or your e-mail account has been hacked, this shouldn't be an issue.

Re:Only broken if e-mail cracked

[koalapeck]

I've witnessed more than a few websites where once you successfully answer the security question they reset the login directly in the browser, freeing you to choose a new password then and there. This is where I'd be concerned.

Re:Only broken if e-mail cracked

[Anonymous Coward]

Any idea why lots of phishers want your email password these days? And there are lots of shady social networking sites that ask for your gmail password, etc, to automatically send emails to your friends to promote their site. Email is not very secure...

Re:Only broken if e-mail cracked

[mr_mischief]

I'd be less worried about your individual email account and more worried about that Exchange installation on the NT4 box in the janitor's closet that your employer uses as a mail server. Having everyone's password reset data is better and often easier than having just yours.

On lower-security sites like this, I tend to send a password reset link with a long (about 40 character) random string as part of the URL that is good for 24 hours, until the password is reset, or the "I did not request this reset" link is followed instead. You'd be surprised how many people get a password sent to them in an email then refuse to change that.

Re:Only broken if e-mail cracked

[IdolizingStewie]

Hey, if you don't care about a site, your email is as good a place as any to store the password for it. Obviously I don't use that for anything secure, but for here, for example, why not?

my first car was

[FudRucker]

a 1969 Pontiac GTO, wait, you did not read that!

Re:my first car was

[roc97007]

Cool. Wanna sell it?

American Express...

[roc97007]

...wouldn't activate my card until I created a pin. They wanted me to use the month and day of my mother's birthday. I tried random digits, but -- fer chrissake -- the menu system would only take digits that were valid dates.

Yeah, that's what I want to use for a card with no spending limit, a datum easily discovered through public records.

I finally got hold of a real person, and he insisted I use my mother's birthday. I insisted that I would not. He finally had to get permission from a supervisor for me to use a random four digit string.

I understand, insisting on an easily remembered string probably reduces the number of support calls to reset pins, but at what cost?

Re:American Express...

[base3]

Yeah, that's what I want to use for a card with no spending limit,

That's not technically true. There is a spending limit; they just don't tell you what it is until you hit it.

Re:American Express...

[narcberry]

to them? nothing.
The only reason they let you at all, was you were tallying up a call time over 5 minutes.

Re:American Express...

[CastrTroy]

They must be taking lessons from Comcast. It's Comcastic!!!!

Re:American Express...

[mr_mischief]

So that's what they mean by "no preset spending limit" in their ads? Fair enough, I guess. Still, the control freaks among us would probably rather know.

Most credit card companies are fairly reasonable on at least one issue, even if they are total assholes about everything else: if you're a good customer who rarely gets near the limit for long and always pays on time, they're generally willing to bump your limit up a bit to get you to pay more interest. All it usually takes is a call to them saying that since you're a solid customer in good standing and you need a little extra credit right now, you'd appreciate getting that credit through their company where you have an established relationship instead of paying interest to their competition.

Re:American Express...

[Menkhaf]

That's not technically true. There is a spending limit; they just don't tell you what it is until you hit it.

Heh -- that reminds me. In Denmark we have a national debit card, the Dankort. Since 2006 a company called PBS has handled all transactions with these cards.
For some reason, the cap on how much money you can charge from your card is set by the transaction terminal/machine. That is, if it is set at all. If it isn't set at all, PBS sets the upper limit. At around 16 million DKK, equating roughly 3,2 million USD.

Last year, a lady goes shopping. The guy at the cash register accidentally enters, uhm, way too many zeros. Being in a hurry, the lady just confirms the amount without making sure if it is the correct amount. Seconds later she realizes that she has just charged 16 million DKK from her account.
The store eventually agreed to pay a compensation for the few thousand DKK of interest that had accumulated overnigth.

Wikipedia on Dankort

Re:American Express...

[MrMr]

, but at what cost?
Hmmm, just post the names and numbers here and we'll compute the cost for you.

Re:American Express...

[Anonymous Coward]

You couldn't just make up a valid date that wasn't your mother's real birthday? Or did they need to see her birth certificate too?

Re:American Express...

[againjj]

So, this means if I find an American Express card, all I have to do is look up the person named on the card and find out the birthdate of that person's mother? Scary!

Re:American Express...

[roc97007]

> You couldn't just make up a valid date that wasn't your mother's real birthday?

I could have, but at that point I didn't want to play anymore. Sometimes we have a moral obligation to refuse to do something stupid just because someone told us to.

very easy fix for this

[v1]

I had to be clubbed on the head to realize this obvious universal truth:

The answer to your "secret question" doesn't have to have anything to do with the stated question.

I got upset at my bank because they only had four questions they'd let me use. Oldest sibling's name. (only child?) First pet. (which one?) Town you grew up in? (which one?) favorite color (don't have one). The really crazy part is these were ALL questions. The bank will randomly challenge me with one of those questions.

After yet another challenge lockout, the rep kindly informed me to just treat the secret questions just like another password field, and put in whatever else you'd like for another password. I could even use the same answer for all the questions.

d'oh. That's easier simpler it looks.

It gets better. The "random" nature of the challenges was bugging me. The rep then said do you want to just make it ALWAYS challenge you? do it! Much better. I need consistency more than the random chance things are simpler. It always sends me looking for my password list when a forum or something I normally visit daily I miss for a few days and it logs me out. Having to enter the password for something every time you use it, and having to use it frequently, is much better for memorizing these things.

Re:very easy fix for this

[PCM2]

First pet. (which one?) Town you grew up in? (which one?)

Ummmm... by chance you wouldn't ever have had a job taking orders at McDonald's, would you?

Re:very easy fix for this

[Anonymous Coward]

I had to be clubbed on the head to realize this obvious universal truth:

The answer to your "secret question" doesn't have to have anything to do with the stated question.

wow ... this is genius! i never thought of that =P
thanks for clubbing me too!! (i'm serious about this. no sarcasm involved)

My solution

[Anonymous Coward]

My solution is to append a 3 digit number I memorized to my answer. For example ford657 or fido657.

Easier to defeat

[MasterOfDisaster]

I would think it would be easier to find out my preferences from looking at my Facebook page than it would be to determine my mother's maiden name, best friend's name or what my first car was - you won't find any of that information spelled out clearly on facebook, but you would be able to look at my "Interests" to see what type of music, tv or foods I liked or view my pictures and see plenty of photos of me in art galleries and raves, but none at sporting events, for example.

Plus, as everyone knows, a multiple choice test is much easier to pass by answering randomly than a something where you have to fill in the blanks.

Re:Easier to defeat

[Anonymous Coward]

Yes, well my last name is hyphenated "A-B", where "A" is my mother's last name (unchanged at marriage) and "B" is my father's name.

So whenever a company/etc. asks me for my mother's name as a "security" question, they don't get a pleasant reply.

Password reset?

[jc42]

So what's the definition of "password reset"? I'd started off assuming that it refers to one of those "I forgot my password" thingies. But the few times I've used one of those (usually helping a friend get a new password, actually), the result has always been for the site to email a new password that was random and unpronouncable, plus a link to change the password.

Are there sites that actually set your password to one of these personal-info strings? If so, that's incredibly demented behavior on their part. I'd think seriously of not using that site any more, if possible.

But I was disappointed that TFA didn't seem to define the "password reset" phrase. So I have to admit that I don't know what he's talking about. And I'm curious, because I've found that stories on new security problems have this way of quickly becoming relevant.

Re:Password reset?

[bill_mcgonigle]

E-mail'ed passwords aren't panacea either. People leave their non-SSL e-mail clients connected all the time on wireless, for instance.

The idea is that you do all of your password reset online. The quality of this system varies widely, and by widely I mean almost all of them are on the "crap" side. So, if you want to get somebody's account, you force three bad logins and answer what the name of their pet dog is, and defeat their 20-digit alphanumeric pasword. I kid, but only half.

There are plenty of researchers who have come up with better systems that are much harder to defeat, but all web-only systems have some weaknesses. I have one site that uses PIN codes via SMS as an alternate channel. Shocker, right, good systems use multiple paths to make compromise harder?

Most implementers only care about security theatre, however, and they don't bear the cost of their shoddy workmanship, so things aren't likely to change.

Lie

[John Hasler]

> The city you grew up in and your mother's maiden name can be derived from public records.

I grew up in Wei9Iequ. My mother's maiden name was ga4EeliY.

Or, if you insist on something easier to remember, make it Tanelorn and Gloriana.

Re:Lie

[greg1104]

Making up your own answers like the ones you suggest might seem fine, but just you wait until someone at the bank challenges you on the phone with to confirm your answer to "what's your favorite sport?" and you have to answer "Moorcock".

Re:Lie

[jimicus]

My mother's maiden name was ga4EeliY.

Must have been a relief for her to get married and not have to spell that any more.

Re:Lie

[archen]

Growing up in hackertown, was it hard learning English as your second language after leet speak?

Re:Lie

[Blackknight]

My hometown is Hometown, IL. Not really, but it's easy to remember.

Re:Lie

[Nebu]

Making up your own answers like the ones you suggest might seem fine, but just you wait until someone at the bank challenges you on the phone with to confirm your answer to "what's your favorite sport?" and you have to answer "Moorcock".

Reading Moorcock is my favorite sport, you insensitive clod!

Re:Lie

[AeroIllini]

Making up your own answers like the ones you suggest might seem fine, but just you wait until someone at the bank challenges you on the phone with to confirm your answer to "what's your favorite sport?" and you have to answer "Moorcock".

Sounds fun to me. I'm changing all my bank security answers to "your security sucks."

Not just your email, either...

[EWillieL]

My wife's business website was routed to a porn site for three days a couple years ago. They transferred the domain from her account to their own account with another registrar, and pointed it to their own DNS servers.

They accessed her account by, you guessed it, compromising her primary email account using the "secret questions". As it turns out, the perpetrators knew all the right answers, because they were her ex-husband and his apparently-vindictive second wife.

They had unfettered access to her email account for over a year while they plotted this bit of nastiness. Such activity is a felony where we come from, but they moved out of the country before charges could be pressed.

Needless to say, my wife uses a bogus set of "secret" answers that even I don't know. Not that she's not trusting or anything... ;-)

Re:Not just your email, either...

[Anonymous Coward]

>Such activity is a felony where we come from, but they moved out of the country before charges could be pressed.

Since they went to a country without an extradition treaty, the food and water situation is punishment enough.

Re:Not just your email, either...

[RealGrouchy]

Not that she's not trusting or anything... ;-)

"Trust everybody, but cut the cards." - Finley Peter Dunne

- RG>

Re:Not just your email, either...

[EWillieL]

Naah. It's just not enough of a felony for the county attorney to go through the hassle. But if they ever turn up here again, we could inform the local police, which would probably make their visit... um, interesting.

Re:Not just your email, either...

[mr_mischief]

Moreover, if there's no extradition treaty then there's no being extradited to there if someone should happen to be tied to their untimely demise or fraudulent financial ruin then slip back to the original country.

Grocery Cards

[Anonymous Coward]

What do you mean "yet"?

I bet there are a LOT of preferences that could be deduced from the records on your grocery card.

The only good thing is that you do NOT always have to fill out the form. They'll take out a new card, swipe it, then give you a form to send in later. If you don't fill out the form, they don't care. They'll get that information if you ever use your credit card and that shopping card together. Some also let you enter your phone number instead, which once again ties things to your identity (unless you use a specific fake phone number...).

Of course, it's not hard to find loopholes here that still let you maintain some level of privacy. But you have to be careful.

Of course, if you want to be sneaky, keep that blank card unaffiliated with your identity, then offer to let someone else use your shopper card when they're paying by credit card. Should make things interesting.

Personally, I avoid getting the cards entirely if I can't save some privacy. I know that I pay more, but I'm not having my life entered into a database for a $1.25 discount. I'm convinced that people will find ways to systematically abuse this data in the future, and I don't want to find out how they will do that.

Alastair Rankine posted an excellent analysis

[toby]

See How NOT to use 'secret questions' about the bad authentication design of an Australian government web site.

Duh

[Anonymous Coward]

I've always answered question1 with the answer to question2 in order to throw things off. I usually don't forget my passwords, so it never really mattered to me. however, in the last year or so, one of my credit card's website started asking me those questions even though i had entered my password...really pisses me off.

You mean

[rossdee]

..that people might actually give an honest answer to questions like 'mothers maiden name?'

And what about 'first pet?' - I never had a PET as such, my first computer was a TRS80
I did have a C=64 which was a direct descendant of the Personal Electrouic Transactor

Those questions are just prompts, you are't expected to provide a answer that is correct, just the same as what you originally typed in.

And then they send you the NEW password to your Email address. If you used a SECURE email account in the first place, rather that a hotmail, yahoo, or gmail address, there should not be a problem.

Re:You mean

[Comboman]

Those questions are just prompts, you are't expected to provide a answer that is correct, just the same as what you originally typed in.

True, but if I can't remember my password, what makes you think I'll remember a made-up mother's maiden name?

Changing the 'Truth'

[gznork26]

In order to gain access to your Bank of America account over the phone, they ask some security questions to try to confirm that it's you. One of these questions is which branch you opened your account at. Unfortunately, when B of A bought the bank I opened my account at, they changed the record of where it was opened. So now, they expect me to provide a false answer to answer their question 'correctly'. I pointed out to them that if they expect me to lie to them here, there's no reason to expect me to tell the truth anywhere else. Nobody there seems to understand that the precedent it sets would destroy their trust relationship with customers, and I spoke to everyone up to the office of the President.

-------
I write political short stories at http://klurgsheld.wordpress.com/

I accidently stole a guys gmail account

[ozphx]

Couldnt login! Was trying to login to the wrong username (who shared my name), and the guys secret question was "lager?". Of course the answer was "yes". :/

That probably makes me guilty of all kinds of nasty shit by accident :P

Yes, my preferences are stable

[tauntalum]

And they're set to disable scripting.

lesser of the three evils

[Thaelon]

Neither password reuse nor password reset questions are as bad as passwords that expire.

Seriously, everybody knows you pick one password then increment the number on the end. To make matters worse, companies will often shove network drives down your throat via the domain policy, that, once your password changes, lock you out of everything. Security through inconvenience of your authorized users. Great!

Re:lesser of the three evils

[SoupIsGoodFood_42]

I agree. When I was forced to change my password, I just ended up making them very easy to remember and therefore easier for someone else to guess/brute-force.

Re:lesser of the three evils

[jimicus]

To make matters worse, companies will often shove network drives down your throat via the domain policy, that, once your password changes, lock you out of everything. Security through inconvenience of your authorized users. Great!

If you don't enforce this, regardless of what you say lots of people will save everything locally and you either wind up having to backup (and be prepared to restore in the case of hardware failure) an inordinate number of PCs or you have people losing data when their PC dies.

This would be substantially more of a problem than dealing with forgotten passwords.

Re:lesser of the three evils

[cparker15]

To make matters worse, companies will often shove network drives down your throat via the domain policy, that, once your password changes, lock you out of everything. Security through inconvenience of your authorized users. Great!

If you don't enforce this, regardless of what you say lots of people will save everything locally and you either wind up having to backup (and be prepared to restore in the case of hardware failure) an inordinate number of PCs or you have people losing data when their PC dies.

...Huh? Don't you mean if you do enforce this...?

Re:lesser of the three evils

[jimicus]

To make matters worse, companies will often shove network drives down your throat via the domain policy, that, once your password changes, lock you out of everything. Security through inconvenience of your authorized users. Great!

If you don't enforce this, regardless of what you say lots of people will save everything locally and you either wind up having to backup (and be prepared to restore in the case of hardware failure) an inordinate number of PCs or you have people losing data when their PC dies.

...Huh? Don't you mean if you do enforce this...?

Could have worded it more clearly, but the bit I'm referring to enforcing is "shoving the network drives down your throat".

Enforcing password changes is dead easy - block the individual PCs from allowing you to login once your password's expired and/or force the user to change it as part of the login process. That's been possible on a Windows domain since NT 4.

Re:lesser of the three evils

[cparker15]

When my password expires on a Windows XP machine connected to an Active Directory domain, I sometimes get a prompt asking me if I'd like to change my password. Although this could be because I only put the machine into Standby when it's not in use. I log out maybe once a month. So, when I unlock my machine, and try to start working, I'll often find that I'm unable to work (try working on a non-existent file--or a couple dozen--in Notepad++) until I try to access the drives directly, at which point I get an expired password message.

Anyway, password expiration is a joke. Everyone here uses the same base password and either just increments a number after it by one or appends the month the password was changed to it. My base password is secure enough that John the Ripper hasn't been able to crack it every time I've tried (multiple times over the past five or so years), so it should be secure enough. Really, all password expiration is is an inconvenience.

I agree that NAS is a good idea, however.

The company's statement and original article

[mothrsuperior]

http://www.ravenwhite.com/iforgotmypassword.html

But what about cross referencing?

[EmbeddedJanitor]

Join up with some dodgy site and they harvest your mother's maiden name, pet's name etc. then thy use that info on a site you care about. It doesn't matter if the snswers are bullshit, so long as they match.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Yes there are great solutions!

[EmbeddedJanitor]

Remember what the goals are folks: giving the user a perceived sense of security and making a simple to use mechanism so that you don't end up having to deal with tons of helpdesk/support calls. On those criteria the current mechanisms are great.

That the perception does not match reality is of lesser consequence for the site admin.

Re:Yes there are great solutions!

[Thinboy00]

Remember what the goals are folks: giving the user a perceived sense of security and making a simple to use mechanism so that you don't end up having to deal with tons of helpdesk/support calls. On those criteria the current mechanisms are great.

That the perception does not match reality is of lesser consequence for the site admin.

A perceived sense of security... you mean like with Windoze?

Simple way to avoid this

[jrothwell97]

I always use an answer which is memorable, but completely irrelevant to the question. For example:

QUESTION: What was the name of your first school teacher?

ANSWER: The Handle from a Power Mac G3.

Disclaimer: this is just something I made up off the top of my head. It's not in use. If you try to use it to steal my identity, you're bonkers.

Re:Simple way to avoid this

[Ihmhi]

Yeah, nonsensical answers are the best options.

For instance, according to many websites I grew up in the city of Snatchbasket, WI.

Re:Simple way to avoid this

[John Hasler]

Hey! That's just down the road from here!

challenge vs. response

[Anonymous Coward]

I can remember using decent systems that allowed me not only to create a response, but also MY OWN CHALLENGE QUESTION. Even my bank allowed this. Is it foolproof? No. But it addresses the main point of the article. I used to hate the "what was your first car" question since I don't have a car, never have. And lets be honest, most slashdotters don't have friends. There have been plenty of great security articles on /. over the years not to mention book reviews. I don't need advice from a magazine for managers.

Joe Moyle

[JoeMoyle]

I took a look at the preferences site. I think that any one of my co-workers that are well aquianted with me could access it easily via those preference questions. My initial thoughts regarding this idea is that this is not a secure method of resetting a password that has been forgotten.

Other problems

[Anonymous Coward]

Two other related problems:

1) Browsers remembering passwords for you. Because of speed-dial, I don't know my girlfriend's cell number. Same concept applies. Everything works fine until you have to reinstall the OS then you're foosed.

2) Frequent mandatory password changes with strict requirements. Just how many random alpha-numeric sequences can the average person remember? Naturally people write these passwords down somewhere near their computer and voila: Password is next to useless. If someone breaks into the office, chances are good at least one of the employees has a password in their desk.

My easy solution

[GoodNicksAreTaken]

I never use the city of where I grew up or my mothers maiden name but something made-up or similar. For example, if I grew up in Minneapolis in my system I'd put Miniapple or something stupid that I could remember. Putting a city you wish you grew up in would work also. Something that is totally fake but that you will remember. For my mother's maiden name I use something similar to my grandmothers middle name. As I've been doing this consistently for years I feel relatively secure but unless I suddenly develop amnesia I can recover my forgotten passwords using this made up information. You could easily just say your mothers maiden name was "Banana" or something nonsensical so long as you used that all the time in order to remember you'd used it.

organizations can and should do better with Q&

[Anonymous Coward]

There are lots of good solutions to designing a sound Q&A-based authentication scheme. Here's a white paper that covers the field (warning: registration required):
http://tinyurl.com/6reduc

Not for me

[readin]

Password reset questions don't work for me because I refuse to give out the kind of personal information they ask for. If they force me to pick a password with so many restrictions that I can't pick one I'll remember, then if they want me to have access they'll just have to reset my password manually.

Penny Arcade

[necrostopheles]

http://penny-arcade.com/comic/2006/7/12/a-wider-perspective-on-flavor/

Not PUBLIC per se...

[$random_var]

And very few preferences are recorded in public databases.'"

Many, however, are recorded in marketing databases :-p

I don't know about you guys...

[thatskinnyguy]

...but my password is always ); DROP TABLE user_accounts;

hashapass.com

[robonasty]

I use this to generate passwords. Since one master password yields different outputs for each parameter (i.e. slashdot, hotmail) I'm confident I won't forget a password, so I'm safe typing gibberish into the question fields.

Re:hashapass.com

[z0idberg]

Looks useful.

The only problem I can see would be availability of that site. Unless you are hashing to create the passwords and storing them elsewhere then you are dependent on that site being available.

Re:hashapass.com

[robonasty]

Unless you are hashing to create the passwords and storing them elsewhere...

Usually I use the Firefox password manager to encrypt them with the same master password. Very convenient: since Firefox usually selects the login button, I can just type the master password and press enter twice.

...then you are dependent on that site being available.

Not really, you could always save a local copy of the site. Actually, since hashapass uses SHA1, all you need to do is calculate HMAC-SHA1 for your passwords and parameters, and then encode that to a base64 string.

Workaround

[d_54321]

I've got a great work around.

In fields like "Mother's maiden name:", just enter "mothersmaidenname".

Not derivable from any of your public records, and nobody would ever guess it.

Try it.

Re:Workaround

[miro f]

not very secure. You could try something like:
question->rot13->md5sum
so long as you always use the same technique it's easy to remember, and you shouldn't need to be answering it too often that it's too arduous

I don't believe it

[uberjoe]

That's the same combination on my luggage!

Some woman giving a 401K presentation...

[rthille]

Some woman giving a 401K presentation at my work was talking about their website and how they have the question/answer fall back for when you forget your password. She said not to use a question with a simple, possibly well known answer like "What's your favorite color?" I piped up with my answer, "Fish!"

The point is, just because the question is constant, the answer doesn't have to be, it can basically be a second password.

Re:Some woman giving a 401K presentation...

[Blackknight]

My favorite color is light urple.

PassWord Strategy Has To Be Changed --

[Axe4ever]

Passwords were invented as a way for the user info to be secure.If everywhere something enforces that a password should be of n char length and it should have this many special chars and numbers, mostly users will come up with something that they know too well or are comfortable in remembering. If every site comes up with trying to enforce these password rules, either the user goes with one password everywhere that he logs into, or he doesn't have any other alternative other than writing it down somewhere, rather than committing this to memory. The point is, if he loses the device or slip or whatever, where he writes down all this info .. what is he supposed to do ? Create another user ?? That seems absurd. The password strategy is something which has to be changed in time. OR is it too late ??? By way the things are moving, it seems its too late.

Stupid online quizzes

[nerdonamotorcycle]

I haven't seen very many of these lately, but some while ago there were a bunch of those online memes like "What's your pornstar name?", "What's your rapper name?", etc., where you put in stuff like the name of your first pet and the street you grew up on into a form to come up with the screen name you should use as a pornstar or something. On occasion there's some CGI code that produces a somewhat-randomized answer using your input as the seed. The intent is for you to cut-n-paste the sometimes-humorous answer into your LiveJournal or Facebook or MySpace for your friends to giggle at and possibly follow up with answers of their own.

Have you ever noticed that many of the questions those things ask you are the same things that websites use for "secret questions"?

Whats the whole point of these silly questions??

[madbawa]

I just fail to comprehend the point of these so-called secret questions. Semantics first, the questions are just not secret, Its the answers that are. Also, if someone has forgotten the password that they have been using, how in holy hell can they possibly remember what the 'secret' question was?? Also, people who are somewhat paranoid about security will almost always give some wrong answer to the question which they can be sure cannot be guessed by anybody who knows them. And there lies the problem. Passwords are used more frequently than these questions. So if a person has forgotten their password, they sure as hell can't remember what answer they had given. I think the time is ripe for a radical change in the way we authenticate to these machines.

My solution to the "secret questions"

[pxc]

(when they let you make up the question) is to set the question to "No password hint for you!" and then bang in random text for the answer.

crap. as promised: repost

[SaberTaylor]

repost of comment: 'passwords are bad use asymmetric keys' on Tuesday August 12, @08:07AM (#24566319)

the copy-paste, then the amendment:

The solution to authentication is something like the IronKey (a hardened USB drive for storing passwords) but with asymmetric crypto.

So you would go to Gmail, gmail would send a challenge that goes to the browser. A library on your browser would send the challenge to the USB device. The USB device would respond by signing the challenge asymmetrically, and that signature would route back through the browser to Gmail. Then you have 1 authenticated session until you destroy it. For sake of convenience imagine the implementation as using PGP -- public key, private key. Gmail has the public key, your USB device has the private key.

This is great since you could read your webmail on a friend's computer, or post Slashdot comments without leaving behind a persistent authentication token (barring a fake logout screen). Or there could be a keylogger on your home computer but it wouldn't be able to scrape persistent passwords and pass those on.

The only reason that humans don't use asymmetric security is that we're too stupid. Otherwise if we wanted high security we would be looking at screens of cyphertext and reversing the one-way function (a^b=c) in our heads. Given that we're too dumb, why not do not put our authenticator on a device that goes on a keychain with our other keys? (And you could make a backup just like with your other keys.)

[...]
-- amendment --

- no I'm not talking about a simple USB drive. That's why the IronKey is dumb since a rooted PC could mirror it.
- the usb device could have all sorts of fancy stuff like LED screen or PIN, i.e. it's not just a flashdrive as I said, it does public-private key crypto -- you can't read all its private data by plugging it in. the point is to get support for asymmetric authentication and allow the free market to provide the level of extra nuisance consumers want.
- 90% don't want this, which is good, happy for them, I'm part of the 10%. So the legacy symmetric password support wouldn't go away and the 10% who want asymmetric passwords on a hardened low complexity (complexity is the enemy of security -- that's why your PC is as leaky as a sieve) device would have that option.
- i like bullet points
- proof-of-concept on a smartphone might be helpful.

Roll Your Own Questions

[Bieeanda]

The bank I deal with skips the easily-guessed questions and lets you set your own. On that site, and the sadly few others I've encountered that do the same, I either note in the question that the answer is case sensitive, or remember to put the original answer in lowercase.

It really helps if you're not being a 'clever' smartass-- references to the cultural canon like 'What is the Answer to Life, the Universe, and Everything' or 'To Be, or Not to Be' are going to be guessed by a passing hacker faster than 'Who was the last person to sleep with my mom?' (Answer: me).

Whoa... Peter, is that you?.

[mr_mischief]

Is your hometown, by any chance, Quahog RI?

Re:Whoa... Peter, is that you?.

[Anonymous Coward]

no...it's lando-calrissian

Re:Whoa... Peter, is that you?.

[teko_teko]

No, Peter can't be that smart. His password is probably 'password'.

Re:Whoa... Peter, is that you?.

[rootooftheworld]

Second guess: pass.==peter1

Can anybody guess the name of my old, dead dog?

[Cannelloni]

The little guy died in 1982. I wonder how hard it would be to figure that one out, especially as he had a rather obscure foreign name and a four-digit number too. Yet another uninteresting story. Move on!

password resets aren't the problem

[kayditty]

What a stupid summary. There's absolutely nothing wrong with password resetting. The problem is password security questions or password "hints" or whatever they're called. Whenever I encounter those, I pound on my keyboard until the text field's maximum length is reached, hoping that's sufficiently random and long enough to thwart any brute force or crib-based attacks. It's so bad sometimes that not only do sites require you enter this information, but they also have ridiculously asinine limits on maximum password length and question/answer length. It doesn't matter whether you choose a strong password, if that can be broken by something as insanely weak as an honest answer to one of the 'security questions' that you're provided with on most sites (though some sites let you specify a custom question). Whoever thought up that one was not the brightest crayon in the box, and has no business doing anything with security applications. They may have had the best of intentions, but took a lot of the ideas they've heard from the security field and applied them poorly, which is why you only let EXPERTS design security applications. This is a lot of theater and nothing more, and poor implementation is the classic amateur mistake.

These are the same people who put plain-text passwords in a database or text file and let you "retrieve" your password which they've conveniently stored, unaltered. Sometimes, if they want to feel really clever about themselves, they might upgrade to un-salted MD5. Yay. There needs to be an industry standard system for web applications, or whatever else, designed by someone who knows what they're doing. Don't roll your own security suite. You're most likely not smart enough, even if you think you are. I use Solar Designer's phpass for cryptographic hashing in my web applications, and he has several other good pieces of software that are relevant to the topic.

The process I use for password resets goes like this (starting from the very beginning):

1. user goes to the registration page for my website
2. the user is given guidelines on password strength, but these aren't enforced, because it's their own ass if their account gets compromised (though, if there were any risk to said compromisation, then I would impose strengthening measures)
3. the user provides an e-mail address which must be legitimate (I'm not too keen on this myself, since it's none of my business what anyone's e-mail is, and sites requiring e-mail for registration are annoying, but, if you want any semblance of security, this is probably the way to go)
4. in the back end, the user's plain-text password is converted to salted MD5 or bcrypt (bcrypt for Linux; bcrypt is native to OpenBSD and Openwall Linux) through UNIX crypt()
5. the account is not activated until the user visits a link sent to their inbox, based on a cryptographically secure random confirmation ID (20 bits SHA1)
6. the user forgets his password
7. the user visits the password reset page on my website, inputs their e-mail, and clicks reset
8. a confirmation e-mail is sent to the address on file, complete with a link to a web page on my site with a secure cryptographically generated IP as a GET variable (20 bits SHA1); no password is generated until the link is clicked (or typed in, which I would prefer to clicking, and I don't render e-mail in HTML anyway)
9. once the link is visited, an alternate password is creating using a secure, properly designed and developed cryptographically strong password generation library
10. upon logging in with the new, cryptographically strong password, the old password is deactivated and can no longer be used for logging in

That system is not infallible, but it doesn't require weakening the concept of a password-based system (when such a system is already, inherently, an absurdly flawed and very primitive idea).

Don't actually answer the questions

[Anonymous Coward]

They may ask your mother's maiden name and your favourite food, but your response to those questions doesn't have to actually be the answer to those questions!

Pete Boyd

Obligatory Python quote

[dna_(c)(tm)(r)]

Psychologists know that people's preferences are stable

And the scene at The Bridge of Death:

What... is your favourite colour? Blue. No, yellOOOOOOW!!

I would have a big problem with that...

Re:Obligatory Python quote

[Tim C]

I know you're being humorous, but you do realise that he changed his mind because he was copying the previous guy's answers and realised that he was wrong on that one?

Mother's maiden name can be auto generated too

[Ilgaz]

For sites demanding such info, check the tip from Agile Networks, makers of 1Password. It can be done via other solutions, free or paid too.

(of course, I can't find the tip on their blog)

The idea was, if site demands that question to be filled, you auto fill it with a random password generator. You can make the question to be auto generated password too.

For example:
Secret question: zal3ed2od6ja
Secret answer: yad5uth4yot4

So that stupid potential security breach becomes some sort of challenge/response additional security. Obviously you will need a form filler/extension or it could become major hassle if you lose it.

I answer randomly

[Lachlan Hunt]

I hate stupid questions. I often fill the answer with some long, random crap and don't even try to remember it. I've rarely needed to use them anyway, and on some sites that get answers to those questions upon sign up, they don't even use them for password retrieval. In my experience, forgotten password forms generally just send you an email with your password without even asking the question.

stolen yahoo account

[Anonymous Coward]

I lost my first Yahoo account like that...

I never managed to convince their support to give it back to me, while the profile still shows the url of the website I had back then.

The guy changed the question and some other details (zip, email?) and Yahoo kept asking for those details, not the original info... incompetent amateurs...

Before he changed the data I could take it back 1 time, but he took it back before I could do anything and changed everything... I had seen his email and mailed with him, he "collected" old accounts (with names that were not allowed anymore at that time, mine had an underscore) to use on Yahoo Games.

Now I try to use (and remember ;)) fake data for those questions...

Duh?

[linkskywalker]

Is this really news though? I mean, I've always been one to figure things out slowly, but even I realized when I signed up for my very first email account back when I was 14 that the answers to those questions was common knowledge to a rather large group of people. I've always used a variety of nonsense words for the answers (such as "tiggybup," or some other nonsense.)

Sneaky Info Gathering

[jholden215]

The whole point of this method of password reset protection is that your preferences are not a matter public record or in any databases. Here, at this link in the article intro (http://www.blue-moon-authentication.com/) the nice people at Blue Moon offer to let you PUT YOUR PREFERENCES IN A DATABASE!!! Gah!!! People! Don't be fooled! It's sneaky...

Google Tech Talk

[STFS]

Here's a Google tech talk on this subject (given by this Dr. Markus Jakobsson guy): http://www.youtube.com/watch?v=pypFzJmgPhg

Bruce covered this, twice...

[cffrost]

Bruce Schneier already covered this, first in a 2005-02-11 entry in his blog, and again in a 2008-04-04 essay for ComputerWeekly.

I am absolutely not trying to compare myself to Bruce, but I recognized the weakness of security questions prior to his writings, when I was using his freeware PasswordSafe in 1997. (I've since moved to Keypass... not fucking plaintext Post-it Notes, FFS).

Like Bruce, I've always filled these Q&A fields with 64+ printable ASCII characters via PasswordSafe's/KeyPass's integrated CS-PRNG, which I do not record. When I can provide the question, even better. Two crazy-ass-long fields for an attacker to guess.

It should be obvious, no? A constrained set of questions (2-4 bits of entropy), each with a correspondingly constrained set of answers... ("First make of CAR???" You gotta be fucking kidding me... Why not be done with it, and offer 2kB dictionary downloads for brute-force attackers right on the Lost Password form?) Compare these constraints to a proper, lengthy CS-PRNG alphanumeric pass[word|phrase]... No contest.

Use random data !

[TractorBarry]

I really don't understand why anyone would use something like their actual Mothers maiden name to reply to the question "What is your mothers maiden name". It would take all of 30 seconds to get that sort of information from tha intarweb. Personally I use things that are stupid but memorable to me. i.e.

Q: "What is your mothers maiden name ?"
A: "An Electric Owl"

Q: "What was the make of your first car ?"
A: "Triple Bad Blackstuff"

Of course the problem you then get is that when you have to talk to the uninterested, underpaid support staff at the bank, they sometimes can't cope...

Them: "but that's not a real name"
Me: "That's the whole point".
Them: "I don't understand ?"

Now try using dates in the future for your birthday etc. and watch their system fall in a heap.

Both the questions and answers used in these systems should both be settable by yourself.

"Security" questions...

[EmagGeek]

The answers to most typical Security questions can be found in the internet.

For example, your mother's maiden name is a matter of public record, as is the place you went to high school, usually (most people advertise this on their Facebook page or elsewhere, anyway).

Security questions only make it easier for someone to steal your identity. The whole point is that they're supposed to be questions that only YOU know the answer to, but that is seldom the case. I just treat these as I do any other password and make them random strings of characters and symbols.. it's the only safe way to do it.

Real Story

[db32]

People do insecure things. There is nothing wrong with the questions as they are now. I have a verification question somewhere that asks where my mother was born. I don't remember that crap and I'm not going to call her every time I have to get into that account. So...I lied and answered it with something I would remember. Hell, if your account is BankFoo you could just answer all of the questions "BankFoo" and not have to worry about someone getting the real information or you having to remember what you put.

This seems fairly non story.

Harder than the password

[Joebert]

I realized this years ago, it seems like it should be common sense to me & I'm actually baffled that anyone actually enters information like that.

I never anticipated losing my password, so I always sign up for things with my REAL details and enter more random letters and numbers for the secret question than my password has in it.

Worst case scenario I have to call the place up and tell them the details I used to sign up with, sometimes I get lucky and can send a password reset email to myself.

Re:Harder than the password

[Joebert]

Oh yeah and the sad part is, I used to look over my list of passwords before chosing new passwords just to make sure my brain wasn't using some sort of phonetic pattern between passwords that would make guessing passwords easier if one was compromised.

Huh? Isn't the answer always...

[Anonymous Coward]

I don't know about anyone else but the answer to all of those questions is "Beer". Isn't it? Or is it "Free, as in Beer"?

If you can't trust your people you've got problems

[davidwr]

While passwords-on-stickies is never a "good" idea, if you are fortunate enough to work in an environment where everyone is trustworthy and nobody snoops around looking for passwords and outsiders aren't allowed in the work area, then this isn't a problem.

If you have employees who aren't trustworthy, you've got a much bigger problem.

you are so clueless

[Anonymous Coward]

As far as the bank (and most country's laws) is concerned, when your account is accessed using the security checks (question/answers) you instructed them to accept YOU DID IT. So you can claim all you want that someone hacked your account but they've got solid reason to believe that you did something you've now come to regret. TS.

A bank is only interested in providing better security for online account access to the degree that it gets you to use the cheaper-for-the-bank online account tools instead of an expensive teller or ATM. That's why chip-and-pin solutions were deployed in the UK and Europe after slow Point-Of-Sale adoption by consumers there relative to the US (which still hasn't received them).

Its also why the Treasury Department upgraded online access controls (http://www.treasurydirect.gov/indiv/help/TDTutorial/tutorial.htm/) for the "TreasuryDirect" accounts (which cost the Treasury Department less to administer than their older "Legacy TreasuryDirect" accounts) after the inital deployment saw such low uptake/conversion rates.

Hotmail used to be good for this...

[g0bshiTe]

I've conned many a friend and family member into thinking I had Jedi powers, back when Hotmail used to ask "What is your zipcode?" as an option to allow access to an account in the event of a lost pass.

There is actually a problem...

[EgoWumpus]

As we all know, any single password used across multiple sites is terribly insecure. In a way, that response, 'Judy Garland', is less secure; it may be counterintuitive to someone guessing your password, but once they have that key, they have all your keys.

Worse, arbitrary selections for your responses means that if you ever do change it for security reasons, you're not guaranteed to remember it. For this reason biometric or, as suggested in TFA, cognitive-metric information is useful because it's likely to be unique, hard to guess, varied and hard to 'forget'.

using psychographic data to reset the password

[konberg]

This is perfect: after your users indicate their preferences/interests, you have a set of psychographic data linked to their login and online behavior and you can deliver targeted ads! Modern Metrix blog: mmx.typepad.com

All too common in government

[Anonymous Coward]

A major financial regulator has a mainframe.
Its users forget their passwords.

To get a new one, they need to verify their identity with this type of lame data that anyone can find online, especially if the employee has a blog or a facebook page. Even references to the time someone started at a company are easy to find (look for blog posts that read "this month marked my 14th year with [regulatory agency]").

It's just stupid. They're waiting for a hack.

Re:If you can't trust your people you've got probl

[omfglearntoplay]

"If you can't trust your people you've got problems", said the network cracker.

It takes a brain...

[Orig_Club_Soda]

Do you guys provide the real answers to these questions!? Sure, have a stand set, but make it up. For instance, I have a pet name, but no pet.

Password Reminders DO make it easier.

[Popsmear]

I was looking up selling my steam games on ebay and then discovered it was not "legal". I also happened to find someone who took a screen shot of their steam account games page. Which just happened to have his full email address.

By googling his email I was able to determine which college he went to and worked at the radio station. He also had a facebook that listed his home town.

I attempted to log in to his email account (Yahoo!) and tried to do a password reminder. It asked me what his high school mascot was. There was only two high schools in his town and I made a guess. I was right.

I then had access to his account and all it took was a little googling and an educated guess. Password reminders are the devil. Luckily I was nice enough to do nothing with it.

Yes, and I just fired him

[davidwr]

said the network cracker's ex-boss as his just-terminated former employee was being escorted out of the building, in handcuffs.

just *lie*! geez!

[Anonymous Coward]

do people use their *actual mother's* maiden name for that stuff? it never crossed my mind that they might -- but of course computers know everything, and it won't *work* if you use a fake name. right?

What is your greatest fear?

[chihowa]

The "What is your dream job?" question reminds me of a question asked by the lender of my student loans. There's something a little disturbing about someone that you owe vast sums of money to asking what your greatest fear is!

Interesting idea; problem with the reset portion

[Anonymous Coward]

When answering the questions to authenticate yourself, they happen to go in a yes, no, yes, no... order. That's pretty dumb.

And if they've made such a silly decision like that straight out of the gate, I wonder where else they're making decisions that are RFD (really fucking dumb)?

My solution for geeks:

[Teddy Beartuzzi]

Use something no other human could possibly know... Your penis size. :)

one almost foolproof way

[dougal04]

Store all your passwords/usernames/questions in an excel file that is in an encrypted truecrypt [www.truecrypt.org] volume. Use opera [www.opera.com] as web browser and wand [ctrl+enter] (no typing) all paswords so keyloggers cant pick up answers/entries. And yes truecrypt volumes have passwords so don't forget it. (the password to all your passwords) Most /.ers problaly could figure out how to use truecrypt.

from the graviator

[graviator]

Here is one way to get a good password.Go to the library and find a book copy one or more pages use the word's on that page/page's and change what you like or don't like down to a single letter in differance from the original script and change it once a week or something like that.of course once you tell your girl friend or wife it's all over it would be like cheating!

Another Serious Issue Not Being Addressed Here...

[bratwiz]

There's another issue I'm not seeing addressed here that is problematic with many sites is that they ask too many personal questions, often times for no good (legitimate) purpose (though perhaps not maliciously). Often they ask (at various points, registration, age verification, purchase, etc) for your name, address w/zip code, age (birth date), mother's maiden name, etc. And if making a purchase will then typically get credit card info, 3-digit "security" number on back, name as it appears on card, possibly additional address(es) if billing and/or shipping addresses are different, phone numbers, possibly even enough to figure out where you work if the number can be reversed, and lots more. And the situation can be magnified / expanded if the site owner has multiple web sites that you frequent or belongs to some sort of merchant association (or hacker association) that shares the info amongst its "affiliates".

The very real concern is that through "routine operations", many (most?) sites collect enough information about you to quickly and fairly easily "become you", i.e. perpetrate an identity fraud. Many if not most of the questions and information requested via typical account registration and age verification are the fundamentals needed to establish an identity. The mother's maiden name is in many cases the icing on the cake. All they're missing is the social security number which many people either mistakenly use or freely (unwittingly) give out without realizing its potential security ramifications. (Although that specific danger is becoming more widely known and people are generally taking more precautions with their SSN's).

Then when you stop to realize that MANY retailers, including major card issuers and merchant processors, have been HACKED and ACCOUNT DATA STOLEN-- there have been reported cases of HUNDREDS OF MILLIONS of credit card information stolen-- what exactly gets stolen, just the card number? Not likely. Probably all the rest of that information the site has collected about you as well, they (the news reporters and press releases) just don't go out of their way to point that out. The most recent one that I recall was a few weeks ago that the parent of TJMAXX (and all its various subsidiaries), Circuit City, etc was hacked and reportedly lost over 40 Million credit card account entries. And I seem to recollect that this was NOT the FIRST TIME this has ever happened to them-- my feeble neurons think they remember a previously reported event a year or two ago involving the SAME RETAILERS in which it was discovered they were using UNENCRYPTED WIFI to transport sensitive account and credit card data to centralized (in-store) collection points. And that it is (was) possible to simply drive up in the parking lot with laptop and favorite pringles-can antenna and pick off the data w/o hardly a thought towards getting caught. Card issuers thump their chests about all their doing to prevent fraud and theft, and point out the consumer is off the hook for purchases over $50 bucks, yada yada yada-- but what they don't tell you is that they don't do shit if your INFORMATION is stolen and you are harmed via IDENTITY THEFT.

Then there's CAPTCHAS... I have read several articles (don't have a handy citation, try google) claiming that nefarious folks are gaming them too. By putting up seemingly innocuous sites, often "free porn/game/whatever" sites, and then making the people who use them answer a "security / CAPTCHA" question which is really a copy of some other site's (i.e., a site they have nefarious interest in) CAPTCHA images, or more recently just individual letters extracted from those images. That way they get free brainpower in solving them. They then use the answers to create databases of image/answers which they can use to further their nefarious goals.

Do you Like Porn

[rossy]

You have forgotten your password, please check the following preferences.

Do you like porn? Like Dislike

Thank you... you have been uniquely identified
as a customer in our database your "pornacopia"
password has been sent.