Hacker News Reader

Comment by aczerepinski | Hacker News Reader

It's nearly impossible to remember what you answered for those questions anyway. For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc?

I don't have a specific favorite movie or song. Lord knows what I entered into one of those boxes a year or two ago. Whatever it was, I bet it wasn't as secure as my password.

View on HN

> For first car did I write "Ford", "ford", "Focus", "Ford Focus", etc?

No biggie, the person telling you at length about the quirks of their first car until you mention what your first car was will happily try them all.

One of the questions my bank asks is what middle school I went to and I used my elementary school by mistake. I just listed every school I went to to the guy on the phone when trying to unlock my account. It's a good thing they also ask for SSN/amount previously in the account/who your last check was made out to and that sort of thing.

A secret question asked by a bank would be a strong hint for me to take my money elsewhere. They definitely should be using one-time keys from a paper slip or some similar third factor.

Does any bank (or anyone, actually) really do this though? It's easy to say you should take your money elsewhere, but where would you actually take it?

Santander International do for a start.

Answered the sibling already, but I have experience only with European banks where I don't see this happening. I have account in two banks, both of which provided a paper slip with one-time authorization codes.

One european bank I have account at uses security question, but it seems to be only used as additional layer of authentication when you make changes to your account settings (in person) and not for anything online.

My bank goes a step farther and requires me to physically show up in their branch office and verify my ID. It has to be the branch near my residence.

It's not a bother since it's a 5 minute walk but I imagine that it would be hard for anyone other than me to actually do this, they'd have to show up there and convince the people there they are actually me (and some of these people now me personally)

I'd say that this would be the optimum in security.

In Finland they all do. Before mobile apps, they mailed you cards with one time passwords in them, every time you logged in you had to provide your account number and OTP. Also, every time you confirmed a payment, you had to use a random security code from said card.

These days they provide apps for phones where when you make a payment you have to open the bank app and enter your PIN to confirm the payment. Same for logging in to online banking (for which there are mobile apps as well).

Also, when making a debit/credit card payment online, you also have to confirm it with one of the aforementioned methods. You can't do anything with just the card details.

I can't believe some banks around the world use plain old passwords only...

https://en.wikipedia.org/wiki/Transaction_authentication_num...

If a bank doesn't offer something like that, but still happily does online banking, I'd take my money... anywhere else, even a mattress or the sugar jar.

Well, never put yourself in a position where you need a bank account in the US then.

That's a nice idea, but at least every us bank I've seen does this, so...

That's definitely a bit tougher then. I have experience only with European banks that don't do the security question theater.

I'm of the opinion that the answer to those questions should have nothing to do with the question. Make of first car? Equilateral.

EDIT: like this https://news.ycombinator.com/item?id=14856834

I started to store them in my password manager for that very reason that months later I'd never remember exactly what I put down.

Then the next point is realizing since they are "bonus passwords" anyway you might as well randomize them and use password fields. (In the Advanced Fields properties of an entry in KeePass, for instance, you have a key-value store and when you add one the "Protect in Memory" treats the value the same as KeePass treats other passwords.)

The final realization was that these questions should probably be labeled "Phone Passwords" and in which case use something like Diceware that produces easily pronounceable over the phone passwords.

When they ask you for a first car you should answer, for example, "yellow" or "miskatonic university". When they ask for favorite music band you answer "ford". Choose random words or even random strings. Nothing related to the question itself. Just write them down. Most password managers allow you to add a notes. Of course only when you can't avoid "secret" questions... At least no one will be able to profile you and guess the answers.

Lets see, when I answered this question was I listening to heavy metal, classical, country, or... I happen to enjoy all of the above at times despite them being vastly different they are all music (or can be - I have heard examples from all 3 that are not)

Reply on news.ycombinator.com