Hacker News Reader

Comment by miles | Hacker News Reader

From the comments section of the linked blog post comes this quote (apparently) from Ben, the CEO at Site5:

To be rather blunt you should have better security questions. You should always put in a custom answer, for example I might use the question mother's maiden name and then the answer is "L@J-289098=a9jaosdjf" which I keep in an encrypted text doc or ecrypted note in 1Password.

Not a bad point.

View on HN

Maybe Site5 should ask better security questions then. If they want users to enter what is effectively a password for "Mother's maiden name" they should just ask for a security password.

I agree that the true-to-life reminder questions are probably an outdated model. However there's nothing intrinsically wrong with the maiden name question. There is no server-side code checking in with your mother or running her middle name against a federal database, you can enter whatever you want in the box. Surely people who are savvy enough to be trading in Bitcoin realize this.

  However there's nothing intrinsically wrong with the 
  maiden name question.

Asking users to enter their mother's maiden name, when you actually think they certainly shouldn't do that, then blaming your customers for having used their maiden name, seems like an odd way of doing it.

If mother's maiden name isn't a good enough security question, stop asking it! And we all know it isn't a good enough security question.

Maybe Site5 should ask better security questions then.

Looks like they have allowed users to create their own for quite a while:

We have allowed customers to write their own security questions for over two and a half years now.

http://www.site5.com/blog/s5/security-and-social-engineering...

Yes

It's a pain, but I don't trust this "Mother's Maiden name" invention.

Problem is remembering this (and some offline systems have it as well, oh well)

So if you think I'm going to put the actual name there you're wrong. Maybe not +@sfghh#54$=24 but something different.

To paraphrase: the question 'What is your mother's maiden name?' is intrinsically insecure as a security measure; instead of answering it directly, make up some unguessable string that has nothing to do with the question.

Sound advice, but... but... but.....

This is his own website using this as a security question!

It's about the target audience. Most normal people aren't going to be using their registered domain name for extremely high-value and highly targeted stuff, and they'll be upset if you say "Oh, you forgot your random string? Well, I guess you're screwed bub, sorry". But if you're doing something involving btc, you should be conscious enough to know "maybe I shouldn't put the security of my account behind easily locatable public info like the name of myself or family members".

1) They shouldn't be asking this type of question in the first place. They're promoting insecure practices, and can't seriously expect all their customers to know they should lie in their answers.

2) Knowing the answers to those questions shouldn't allow an attacker direct access to the account. It should initiate a password reset via email.

re: 2- the attackers apparently had an email address very similar to the victim's email. Most likely just convinced the tech support that the victim's email addr had a typo.

Either way it's Site5's fault. They need to be aware of social engineering attacks.

At that point, what is the point of the secret question in the first place? If I lose my password, I probably also lost my security answer, and even if they're stored in separate places, then isn't it just another vector of attack which does nothing for my security anyway?

Reply on news.ycombinator.com