Password Resets Worse Than Reusing Old password 420
narramissic writes "We all know well the perils of password reuse. But what about the information used to reset passwords? Many sites use a standard set of questions — your mother's maiden name, the name of your best friend, what city you grew up in, or what brand your first car was. And you probably have a standard set of responses, making them easy to remember but not very secure. 'The city you grew up in and your mother's maiden name can be derived from public records. Facebook might unwittingly tell the name of your best friend. And, until quite recently, Ford with its 25% market share had a pretty good chance of being the brand of your first car,' says security researcher Markus Jakobsson. But 'password reset does not have to be a weak link,' says Jakobsson. 'Psychologists know that people's preferences are stable — often more so than long term memory. And very few preferences are recorded in public databases.'"
HA! (Score:5, Funny)
Fooled them. My first car was a Chevy!
Preferences are stable? (Score:5, Funny)
Galahad: Sir Galahad of Camelot.
Bridgekeeper: What is your quest?
Galahad: I seek the Grail.
Bridgekeeper: What is your favourite colour?
Galahad: Blue. No, yel...
Those are all dumb and easy cracks (Score:4, Funny)
Password reminder hints problems (Score:4, Funny)
So I did went to the password retreival page, entered in my email address and it asked me the stupidest hint question (for me) ever: "What was the make of your first car?", it didn't make sense at all because I still haven't bought my first car!
Re:pff (Score:5, Funny)
'Other' Questions (Score:3, Funny)
Many websites allow you to use your own question, rather than a preset one. "What is the movie you'd most relate to your high school career?"
"What was the name of craziest teacher you had?"
Better yet, "On Tuesday mornings, which newspaper did you always use to cut out little robot people?"
Re:I NEVER use these fields (Score:5, Funny)
My bank uses a PIN in additional to the login. This actually makes sense to me - as PINs are generally easier to remember than my 10 digits random char-lists, but moreover it's at least honest about the purpose of these extra fields - and doesn't dupe people into leaving their pants down when the DB gets hacked one day.
So you think someone is going to hack the login database for a bank and is going to be focusing on the fact that your first pet's name was Mittens?
Comment removed (Score:5, Funny)
Re:pff (Score:2, Funny)
Re:HA! (Score:5, Funny)
Fooled them. My first car was a Chevy!
*database updated*
Re:'Other' Questions (Score:5, Funny)
Or, "Where did you bury the body of your eleventh victim?"
Too bad this guy wasn't you ... (Score:3, Funny)
Wait a minute... (Score:4, Funny)
How do I protect myself from THEM?!
Re:Well, at least's that's a little secure (Score:3, Funny)
It's pretty hard for a virus to read what's beneath the desk. Not impossible if the virus can control your employer's security cameras, but difficult.
If they're under your desk I don't think those are security cameras.
Re:I NEVER use these fields (Score:5, Funny)
Re:pff (Score:2, Funny)
Re:pff (Score:1, Funny)
Re:pff (Score:1, Funny)
I accidently stole a guys gmail account (Score:2, Funny)
Couldnt login! Was trying to login to the wrong username (who shared my name), and the guys secret question was "lager?". Of course the answer was "yes". :/
That probably makes me guilty of all kinds of nasty shit by accident :P
Re:Even worse... (Score:2, Funny)
Let me guesss... 42? 1337? 3.141592653589793helpimtrappedinauniversefactory7108914...?
Re:Even worse... (Score:4, Funny)
Posting anonymously because I don't want you to look into my accounts and attempt to get into them!
Re:Even worse... (Score:5, Funny)
Re:'Other' Questions (Score:4, Funny)
Re:Are there any good solutions? (Score:4, Funny)
Dude, you don't get it ROFL
If you can't get logged in, when you call their help desk they ask you the questions! You have to give some soft spoken girl the answers... ROFLMFAO
I thought about 'eatshitcunt' as an answer, but that just wouldn't work out right
I don't know about you guys... (Score:5, Funny)
Workaround (Score:3, Funny)
I've got a great work around.
In fields like "Mother's maiden name:", just enter "mothersmaidenname".
Not derivable from any of your public records, and nobody would ever guess it.
Try it.
Re:pff (Score:1, Funny)
My mother's maiden name was 12345
My mother's maiden name was Robert'); DROP TABLE Customer;
Re:Just lie! (Score:4, Funny)
Just lie on these questions! Put in answers you would know, but aren't factually correct.. =)
I have enough trouble remembering the factually correct answers (when the hell is my birthday again?), nevermind the lies.
Re:pff (Score:2, Funny)
Re:HA! (Score:5, Funny)
Re:Wait a minute... (Score:5, Funny)
Mother's Maiden Name: lando-calrissian
Favorite pet: lando-calrissian
Year you were born: lando-calrissian
Best friend: lando-calrissian
Guess that, suckers.
Re:Even worse... (Score:5, Funny)
You're lucky. I'm still confused by what happened to me.
He said, "Mr. Wong, your confirmation question is, 'What did Eve first say, when she saw Adam?'.".
"Hmm, that's a tough 1."
"Yes, that is correct. Now, the deciphering question is, 'How does a foobar ask a question?'.".
"What?"
"Yes, that is correct. Will there be anything else for you today, Mr. Wong?".
Whoa... Peter, is that you?. (Score:3, Funny)
Is your hometown, by any chance, Quahog RI?
Re:Preferences are stable? (Score:2, Funny)
Politician: Defender of the public, famous war hero, community organ grinder...
Bridgekeeper: What is your quest?
Politician: I seek the Presidency.
Bridgekeeper: What is your personal stance on illegal immigration, foreign policy, abortion, the war on terror, etc.?
Politician: Uhmmmm... It's very wide. Let me check the polls.
Re:Lie (Score:3, Funny)
Making up your own answers like the ones you suggest might seem fine, but just you wait until someone at the bank challenges you on the phone with to confirm your answer to "what's your favorite sport?" and you have to answer "Moorcock".
Re:Are there any good solutions? (Score:5, Funny)
Well the easy solution is to use a random string of characters.
"My first pet was 4fgTY2k11."
Make sure you use numbers and both lower and upper case letters at least.
How are you gonna remember this in 10 years though? Easy! Store it in a file called "passwords.txt" in your My Documents folder. Works for me!
Re:pff (Score:5, Funny)
Seriously, I do reuse passwords -- I use the same pw for low-security sites (message boards, excluding slashdot)[...]
Why do you exclude Slashdot? People don't gain anything compromising your account here. I use the same pw on all sites...
Re:pff (Score:5, Funny)
Re:Wait a minute... (Score:2, Funny)
I love the ones that allow you to choose your own questions as well. I always pick ones that I know someone in IT would be able to pick, but aren't really from the IT field, per se.
"What is the airspeed velocity of an unlaiden Swallow?"
"Oh fiddle-dee-dee. That will require a ..."
It allows my employers to choose a successor should I pass on, and my brother a chance to clean out all the incriminating evidence from my web presence should he need to.