Absurd "Security Questions"
-
kdmote wrote:
Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?".
That's actually quite a good question as it allows obfuscation. The answer to that question is Desmond, as in Desmond Tutu.
“That which can be asserted without evidence, can be dismissed without evidence.”
― Christopher Hitchens
If you give a logical answer, it can be logically guessed, and the guesser will then own your account. But what really makes me laugh is that facebook users typically give away every detail that's ever asked by these questions.
I wanna be a eunuchs developer! Pass me a bread knife!
-
So is it OK if I reset all your passwords, this week-end?
I wanna be a eunuchs developer! Pass me a bread knife!
-
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
But it makes it so much easier to steal your identity if we know what street you grew up on and what your high school mascot was.
We won't sit down. We won't shut up. We won't go quietly away. YouTube and My Mu[sic], Films and Windows Programs, etc.
-
Matt T Heffron wrote:
Many of us "old-timers" do know what we're doing!
Were those topics explained in detail during your education, or did you learn it in the field? My guess would be the latter.
Bastard Programmer from Hell :suss: If you can't read my code, try converting it here[^][](X-Clacks-Overhead: GNU Terry Pratchett)
My education pre-dates the Internet by about a decade! But, even with my having learned it in the field, the "recent degree" probably is still a relevant differentiation.
"Fairy tales do not tell children the dragons exist. Children already know that dragons exist. Fairy tales tell children the dragons can be killed." - G.K. Chesterton
-
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
Quote:
Simply let the user write his/her OWN question and answer
I remember some sites offer this way and it's not a bad idea too.
-
There wasn't any education in this, back when I studied. Hackers didn't exist. Unsurprisingly, trolls did, though -- it's probably true that they've been around since the dawn of time.
I wanna be a eunuchs developer! Pass me a bread knife!
-
Eddy Vluggen wrote:
your argumentation is based on calling me an idiot
I don't see how you arrived at that conclusion, but no problem: I'll happily call you an idiot if you'd like. It wouldn't matter anyway, because I only exist as bits and bytes on the Interwebs -- non sum in rerum natura, and all that
I wanna be a eunuchs developer! Pass me a bread knife!
-
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
I don't think they're absurd and don't find them annoying, and several of the sites that I use do allow you to add your own question/answer set.
#SupportHeForShe Government can give you nothing but what it takes from somebody else. A government big enough to give you everything you want is big enough to take everything you've got, including your freedom.-Ezra Taft Benson You must accept 1 of 2 basic premises: Either we are alone in the universe or we are not alone. Either way, the implications are staggering!-Wernher von Braun
-
Quote:
Simply let the user write his/her OWN question and answer
I remember some sites offer this way and it's not a bad idea too.
As in - You don't think you're going out dressed like that, do you? to which the answer is - You can't tell me what to do, you're not my real dad.
-
I don't think they're absurd and don't find them annoying, and several of the sites that I use do allow you to add your own question/answer set.
#SupportHeForShe Government can give you nothing but what it takes from somebody else. A government big enough to give you everything you want is big enough to take everything you've got, including your freedom.-Ezra Taft Benson You must accept 1 of 2 basic premises: Either we are alone in the universe or we are not alone. Either way, the implications are staggering!-Wernher von Braun
You are, of course, entitled to your opinion... and maybe the questions aren't as absurd in the lovely land of Oz, but when I am asked to choose one of several questions, each asking for my "favorite" thing among categories in which I have no preferences (ice cream, sodas, sports teams, etc) I find it extremely frustrating. Like you, I have run across a few sites that allow users to write their own questions, but these sites are by far the minority. May their tribe prosper!
-
Yeah, your first pet's name and your mother's maiden name are well worth keeping in secure storage, just in case you ever forget them.
I wanna be a eunuchs developer! Pass me a bread knife!
Why would you put answers that can be found in the public domain? Isn't your mom's maiden name supposed to be filled out with answers like, "PassTheBreadKnifePlease"? :) Oops - for you, that might be close to the public domain!
My CodeProject Articles :: Our forgotten astronomic heritage :: My website.
"Sorry, buddy, but this mission counts on everyone being as silent as possible, and your farts are just too much of a wildcard." - Korra to Meelo, "Kuvira's Gambit" -
Why would you put answers that can be found in the public domain? Isn't your mom's maiden name supposed to be filled out with answers like, "PassTheBreadKnifePlease"? :) Oops - for you, that might be close to the public domain!
My CodeProject Articles :: Our forgotten astronomic heritage :: My website.
"Sorry, buddy, but this mission counts on everyone being as silent as possible, and your farts are just too much of a wildcard." - Korra to Meelo, "Kuvira's Gambit"Yup, security 101: Never answer a security question with a real answer. All that is required is an answer you can regurgitate when asked. The system doesn't care what the answer is, only that what you present matches what they have. WARNING: If you answer the question: What is your first pet's name? with your spouse's name, DO NOT let her know this. Stuff like that comes back to life more often than Dracula. ;P
-
Another solution is to use KeePass[^], and store your answers in there. At least that way they are encrypted, relying only on one password to remember. It doesn't address your fundamental complaint, but is a method of dealing with the madness.
My CodeProject Articles :: Our forgotten astronomic heritage :: My website.
"Sorry, buddy, but this mission counts on everyone being as silent as possible, and your farts are just too much of a wildcard." - Korra to Meelo, "Kuvira's Gambit" -
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
Two Points: 1) I agree, and I much prefer Authenticator tools like AWS, Dwolla, and my banks use (although my bank still asks the annoying questions) 2) Have fun with it. In order to make my answers hard to guess, I have created an imaginary friend with a consistent life, and I use his answers. You should see the looks I get from my wife when I have to verify something like my mothers maiden name. He grew up near a friend of mine, and went to a different grade school and everything. The worse part is that they are doing 2 things: 1) Storing these as clear text in most cases 2) Sharing your answers with NSA, and potentially with others PS: You can't let the users choose their own questions and answers... The average user? - What is the Worst Bank Ever? - What Bank Really Stinks? - Is there a such thing as a Stupid Question? - Question? (with the answer literally being: answer, then Q2,A2, Q3,A3 ... Then a NYT Article,lol)
-
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
I don't know if we can make our voice be heard. Just wanted to share the worst I've come across. A while back, I was on united.com for some reason; they wanted me to update my account with security questions/answers. Sigh. I guess, ok. Not only are the questions from an enumerated list of possibles, but the answers were as well. Grrrr.
-
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
Use your own has its own issues. I was working at a company that runs websites for managing retirement accounts. One day the call center manager comes running into room where developers work, waving a piece of paper and yelling to shut everything down. She had a screenshot that had the nav and masthead of the site, but the content area had just one word, "fuck" and a submit button. She and several other people thought the site had been hacked and that we should shut it down immediately to prevent data leakage or damage. So we shut it down. The printout didn't show the text input that would have been on the original page, or the address bar to show the offending page location. Turns out some moron set "fuck" as his security question and forgot about it. Then later he forgot his password and went to HR to figure out how to get into the site. The HR manager attempts to use the password reset feature which of course presents the security question and a box to give the answer. HR managers being highly sensitive types are easily offended by websites being profane, and so she sent an angry email with screenshot (without address bar of course). Yes if we had put some phrase like "Your previously chosen security question:" it would have been more obvious what was going on. But at least it made the day exciting. Oh and his answer to that wonderful security question was "great".
-
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
Specifically responding to your update: I wish it was that easy. I work at the customer service level of a financial business that recently implemented "build your own" style security questions. The form is as self-explanatory as can be... Password Reset Security Question {input element} Password Reset Answer {input element} This just confuses the hell out of users. I have to walk an average of one person per day through the process, and thoroughly explain that "here you can type out your own question, which will be shown to you when you request a password reset. Below, you put in the answer to that question." This is a basic concept to those of us who have experience in site development and high-level security concepts... but to the average user, it's mind boggling. In some cases, I even end up recommending that the user leaves those fields blank (in that case, they simply cannot self-initiate a password reset, and must call or come in to one of our offices. It's more work for us, but doesn't add a security risk). There are plenty of people who are far too impatient to even attempt to figure it out, and for them, I'm glad our situation has a workaround for the concept. This isn't to say that the concept needs reworking. Security questions as they are typically implemented are appallingly insecure, and depend on essentially public data. This is bad, and needs to be addressed by the industry at large. On that, we are completely agreed.
-
This is going to sound like a vent (and maybe it is, to a degree), but I really want to go beyond just complaining and DO something about it. I am absolutely fed up with the deluge of inane and ridiculous “Security Questions” that have inundated the web world. I’m speaking, of course, of the ubiquitous websites that require you to answer harebrained trivia questions like “Who was your first Little League coach?” or “Where did you get your first turtle?” or “What kind of apple do you like to juggle with?” These preposterous questions are intended to provide a layer of “security” to my account, in the event that I forget your password. But they are ludicrous because they are useless. They provide virtually no real security – just aggravation to the hapless users who are forced to come up with meaningful but memorable answers. They are either too easy to guess or too hard to remember. The latter must be written down – an intolerable inconvenience that also opens up a huge security hole to anyone who stumbles across your post-it notes. This problem has been around for a long time. Josh Levin complained articulately about it back in 2008. Google acknowledged the absurdity of the strategy in a security document published just last year. I particularly love Dustin’s parody. Nevertheless, the gabberflasting problem remains, darkening our society and threatening to snuff out any remaining sanity in our civilization. What can be done? Where can we protest? Who can be held responsible for these abominations that pierce my spleen like a poison-laced javelin every time I try to register for an online bank account or foosball tournament? Can anything be done to save humanity? Seriously, though. Is there any way we can join together and make our voice be heard? UPDATE: This is especially frustrating because there is a perfectly reasonable alternative: Simply let the user write his/her OWN question and answer. It is easy to think of a question with a single unambiguous answer known only to me. THAT's a system that is both secure AND convenient. ( Of course there will always be brain-dead users who make up a ridiculous question like "What's 2 + 2?". But the whole system shouldn't be gro
-
Specifically responding to your update: I wish it was that easy. I work at the customer service level of a financial business that recently implemented "build your own" style security questions. The form is as self-explanatory as can be... Password Reset Security Question {input element} Password Reset Answer {input element} This just confuses the hell out of users. I have to walk an average of one person per day through the process, and thoroughly explain that "here you can type out your own question, which will be shown to you when you request a password reset. Below, you put in the answer to that question." This is a basic concept to those of us who have experience in site development and high-level security concepts... but to the average user, it's mind boggling. In some cases, I even end up recommending that the user leaves those fields blank (in that case, they simply cannot self-initiate a password reset, and must call or come in to one of our offices. It's more work for us, but doesn't add a security risk). There are plenty of people who are far too impatient to even attempt to figure it out, and for them, I'm glad our situation has a workaround for the concept. This isn't to say that the concept needs reworking. Security questions as they are typically implemented are appallingly insecure, and depend on essentially public data. This is bad, and needs to be addressed by the industry at large. On that, we are completely agreed.
joequincy wrote:
This just confuses... users
This is just a UI/UX problem caused by a web page designer who thought he was limited to a 4 word label. He could have just as easily labeled those fields with: "Please write a question that only you know the answer to." followed by "Now write the answer to that question." I can't imagine verbage like this would stymie the average loser user. Please, joequincy, I beg you: don't let complaints from your colleagues about extra work from the "build your own questions" implementation motivate your institution to retract that strategy. IT IS THE RIGHT STRATEGY. Just get the web devs to implement it in the RIGHT WAY. If I can influence one institution to do the right thing in this regard, I will have fulfilled one of my life's goals.
-
joequincy wrote:
This just confuses... users
This is just a UI/UX problem caused by a web page designer who thought he was limited to a 4 word label. He could have just as easily labeled those fields with: "Please write a question that only you know the answer to." followed by "Now write the answer to that question." I can't imagine verbage like this would stymie the average loser user. Please, joequincy, I beg you: don't let complaints from your colleagues about extra work from the "build your own questions" implementation motivate your institution to retract that strategy. IT IS THE RIGHT STRATEGY. Just get the web devs to implement it in the RIGHT WAY. If I can influence one institution to do the right thing in this regard, I will have fulfilled one of my life's goals.
You mean please type a question, or else it will get written on a "post-it notes"! ;P