Hacker News Reader

Comment by Raphmedia | Hacker News Reader

I simply type passwords in the answers.

"What is your mother's maiden name?" - "gHk899iL@"

This is a good idea. Unfortunately if you have ever in the past (foolishly) answered these security questions honestly, you can't just now start answering them with your password, unless you keep track of which sites have your honest answers and which sites you just gave your password again.

Don't use your password. Generate random passwords for each security question and record them in your password manager.

So-called "security questions" are the dumbest security measure.

I would put a _different_ password rather than the same password. Lots of site store security question answers in plain text for csrs to verify etc.

That's a problem even if you answer honestly all the time. Does this website think my best friend's name is (example) Jake or Jacob?

My solution is just to keep those answers in the "extra notes" section of my password manager.

Did I answer "Ste-Citée" or "Ste-Citee" or "Sainte Citée" or "Sainte-Citee" or ... oh, too late, only had two chances to answer. My account is now locked.

Annoyingly,some sites have started putting limits and validations on their security question answers...

Ran into one where it demanded I choose from a drop-down list, e.g. "What was your first pet" had "dog", "cat", "hamster", "gerbil", etc. I recall the list having a scrollbar, but there was not even enough choices for eight bits worth of entropy.

Oh, and they referred to these security questions as "2FA."

I ran across something similar on United.

https://www.united.com/ual/en/us/account/enroll/default

Derp.

And what if you never had a pet?

I love the ones that ask about one's favourite sports team (not everyone likes sports), or first girl (or boy) friend (not everyone has dated) or first car (not everyone has ever owned a car).

I hated those questions as a kid because I had nothing to answer them with.

Imagine the site complaining that your answer has "too much entropy" to be correct...

Reply on news.ycombinator.com