>Memorized secret verifiers SHALL NOT permit the subscriber to store a “hint” that is accessible to an unauthenticated claimant. Verifiers also SHALL NOT prompt subscribers to use specific types of information (e.g., “What was the name of your first pet?”) when choosing memorized secrets.
I wonder if Mastercard and Visa will reconsider this policy.
My answers to those (when required) always look like this:
> “What was the name of your first pet?” JBK?a0ly(VE3E-|-@BADZFPS<1Fh$X23
Where the "goop" is generated, and remembered, by my password manager (https://github.com/zdia/gorilla/wiki).
It really is scary, in that even my bank will fall back on things that are either easy to obtain or easy to guess, because they clarly have to deal with too many people who either genuinely have no clue, or like me can't be bothered to look up what I've answered. "Telephone banking password? I have no idea what that is. Did I set one? Sorry, can't remember..."
Second, after looking at KeePass (very briefly), it appears to be .net, and while it 'would' run on Linux, I'd have to install .net for Linux (Mono), and I'm just not going to do that.
I've found this to rarely be the case, and when it is there are additional verification steps / notifications that give you a chance to stop it (if it's a new payee).