<story><title>Don&apos;t give away historic details about yourself</title><url>https://krebsonsecurity.com/2018/04/dont-give-away-historic-details-about-yourself/</url></story><parent_chain><item><author>pieguy</author><text>I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options!  Sometimes my answer would not be shown and the correct answer is &amp;quot;none of the above&amp;quot;, but otherwise my answer sticks out like a sore thumb.</text></item><item><author>ConceptJunkie</author><text>The whole &amp;quot;secret question&amp;quot; thing seemed to me to a completely stupid idea from the start.  &amp;quot;Hey, give us password.  If you forget your password, give us a much, much less secure way to access your account.&amp;quot;&lt;p&gt;I&amp;#x27;ve always given false info to those, when I bother to fill them out at all.  If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in.  The security questions they use are often easily guessable (although it seems now they are using somewhat better questions).  Nevertheless, my attitude is that I&amp;#x27;ll just make sure to retain the password.&lt;p&gt;I get the possible security risk of answering quizzes on places like Facebook, but I&amp;#x27;ve done it a few times because it&amp;#x27;s fun.  It all boils down to passwords being a hassle.  Almost anything you do to make dealing with passwords easier makes them less secure, but there&amp;#x27;s nothing better.  The only improvements over passwords come from additional authentication factors, like having to grab a code messaged to your cell-phone, or using one of those little security token devices (or the software equivalent).  I don&amp;#x27;t think anything is going to be replacing passwords any time soon.</text></item></parent_chain><comment><author>jonreem</author><text>Who in the world thought this was a good idea!? I can hardly think of a less secure way to ask security questions. You should name and shame; there’s a minimum bar everyone should uphold and this is far below it.</text></comment>
<story><title>Don&apos;t give away historic details about yourself</title><url>https://krebsonsecurity.com/2018/04/dont-give-away-historic-details-about-yourself/</url></story><parent_chain><item><author>pieguy</author><text>I used to answer secret questions with bogus answers that I deemed unguessable. Then I discovered that when my bank asks me the questions back it does multiple choice, displaying the answer I gave along with 4 other possible options!  Sometimes my answer would not be shown and the correct answer is &amp;quot;none of the above&amp;quot;, but otherwise my answer sticks out like a sore thumb.</text></item><item><author>ConceptJunkie</author><text>The whole &amp;quot;secret question&amp;quot; thing seemed to me to a completely stupid idea from the start.  &amp;quot;Hey, give us password.  If you forget your password, give us a much, much less secure way to access your account.&amp;quot;&lt;p&gt;I&amp;#x27;ve always given false info to those, when I bother to fill them out at all.  If necessary, I just store this false info along with the password in the encrypted file I keep my passwords in.  The security questions they use are often easily guessable (although it seems now they are using somewhat better questions).  Nevertheless, my attitude is that I&amp;#x27;ll just make sure to retain the password.&lt;p&gt;I get the possible security risk of answering quizzes on places like Facebook, but I&amp;#x27;ve done it a few times because it&amp;#x27;s fun.  It all boils down to passwords being a hassle.  Almost anything you do to make dealing with passwords easier makes them less secure, but there&amp;#x27;s nothing better.  The only improvements over passwords come from additional authentication factors, like having to grab a code messaged to your cell-phone, or using one of those little security token devices (or the software equivalent).  I don&amp;#x27;t think anything is going to be replacing passwords any time soon.</text></item></parent_chain><comment><author>furyg3</author><text>This, too, was my problem.  I don&amp;#x27;t want to give out real answers to my security question for two (slightly contradictory) reasons.  The first is: what if this site is hacked? Now my security question answers are floating around for use on other sites that ask similar questions.  The second is: some of these questions are pretty easy to find the answer to, or guess.  So I used a generated string for those questions, too.  Generally worked, but sometimes made for some interesting phone calls.  &amp;quot;My mothers maiden name is &amp;lt;random string&amp;gt;. You can guess why she took my father&amp;#x27;s.&amp;quot;&lt;p&gt;Then they started reading back random choices, which made it pretty easy to guess what I picked.</text></comment>