<story><title>Experian’s credit freeze security is still a joke</title><url>https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/</url></story><parent_chain><item><author>JumpCrisscross</author><text>&amp;gt; &lt;i&gt;generating random passwords for answers and storing them in my password manager&lt;/i&gt;&lt;p&gt;My friend did this. We made a bet. I called his bank and, when challenged for the answers, laughed and said I&amp;#x27;d mashed my keyboard and that it&amp;#x27;s all gibberish. I got through and won a free drink.</text></item><item><author>kminehart</author><text>Security questions in general are a farce. I&amp;#x27;ve started generating random passwords for answers and storing them in my password manager. that at least helps me feel slightly more secure about how ridiculous security questions are.</text></item><item><author>lhnz</author><text>&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;gt; The best part about this lax authentication process is
  &amp;gt; that one can enter any email address to retrieve the
  &amp;gt; PIN — it doesn’t need to be tied to an existing account
  &amp;gt; at Equifax. Also, when the PIN is retrieved, Equifax 
  &amp;gt; doesn’t bother notifying any other email addresses 
  &amp;gt; already on file for that consumer.
&lt;/code&gt;&lt;/pre&gt;
Hang on, so the attacker doesn&amp;#x27;t even need to break into somebody&amp;#x27;s email account first, they can just guess the questions and put in their own email address?! This is insane.</text></item></parent_chain><comment><author>senkora</author><text>The key is to generate incorrect answers that are reasonable matches to the question.&lt;p&gt;Like if they ask for a city, then give a city. If they ask for a name, give a name. Etc.</text></comment>
<story><title>Experian’s credit freeze security is still a joke</title><url>https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/</url></story><parent_chain><item><author>JumpCrisscross</author><text>&amp;gt; &lt;i&gt;generating random passwords for answers and storing them in my password manager&lt;/i&gt;&lt;p&gt;My friend did this. We made a bet. I called his bank and, when challenged for the answers, laughed and said I&amp;#x27;d mashed my keyboard and that it&amp;#x27;s all gibberish. I got through and won a free drink.</text></item><item><author>kminehart</author><text>Security questions in general are a farce. I&amp;#x27;ve started generating random passwords for answers and storing them in my password manager. that at least helps me feel slightly more secure about how ridiculous security questions are.</text></item><item><author>lhnz</author><text>&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;gt; The best part about this lax authentication process is
  &amp;gt; that one can enter any email address to retrieve the
  &amp;gt; PIN — it doesn’t need to be tied to an existing account
  &amp;gt; at Equifax. Also, when the PIN is retrieved, Equifax 
  &amp;gt; doesn’t bother notifying any other email addresses 
  &amp;gt; already on file for that consumer.
&lt;/code&gt;&lt;/pre&gt;
Hang on, so the attacker doesn&amp;#x27;t even need to break into somebody&amp;#x27;s email account first, they can just guess the questions and put in their own email address?! This is insane.</text></item></parent_chain><comment><author>ncallaway</author><text>I generate random 2-4 word phrases instead of random passwords specifically for this reason.</text></comment>