Do use security questions, but with wrong answers (stored in a password manager).
For example, one of my bank security questions is the name of my paternal grandmother, but I used my grandfather’s name instead.
Edit: Also, if the account requires a password recovery passphrase, keep in mind that you might need to tell customer support it. The agent for my gas provider got a good chuckle out of ours being “mmmcrack”
I used to just have a standard complex sentence memorized as my security question reply. No matter what question is asked, I type the properly formatted sentence, with capitalizations and punctuations in all the right places.
The question itself is useless for anyone who is trying to data mine me for access. If they don’t know the sentence I use, and exactly how it’s formatted, then they’ll never get in. I would usually just pick random questions because it doesn’t really matter.
Bonus: Most people don’t use proper punctuation, spelling, and/or capitalization online anymore. So even if they learn the sentence, figuring out how to format it correctly will pose a challenge. Unless they’re an English teacher (or a bibliophile).
My bank has us set up a verbal password to have the tellers do shit for us over the phone. They have a note in mine that if I only say the password and don’t sing it it’s incorrect. I change the lyrics/password like once a year.
I just use additional passwords as recovery answers.
Username:tiddysprinklesPassword:fhg@t2Gxs7...What street did you grow up on:D$pvEb4...What was your first pets name:xwDu#&8w...
Like, okay, so an adversary wants to crack into my account. They’re going to need the unique email addresses for that account, my 60+ character passwords (100+ when allowed), my TOTP… Or the email, and three 60+ passwords…
At some point I’ll need to call up cs for something and answer D$pvEb4… as the street I grew up on. But it’s been a decade+ without a problem…
Do use security questions, but with wrong answers (stored in a password manager).
what would be the point of that? if you know how to and use password manager, then you already have good password you are not going to forget. what would be the point of having secondary password stored in the same database?
one of my bank security questions
i had a client who was getting divorce, because “security question” to his email account was name of the parrot he shared with his wife. they were both in their 70s…
“security question” is the most stupid concept in security. here, in case you forget your password, lets just setup another password, and let it be something so trivial that 10 people already know it and another 100 can easily google or find it on your facebook.
whoever came up with it should be shot together with creator of comic sans. if a BANK demands you to setup one, you should run as far as you can from their service.
Do use security questions, but with wrong answers (stored in a password manager).
For example, one of my bank security questions is the name of my paternal grandmother, but I used my grandfather’s name instead.
Edit: Also, if the account requires a password recovery passphrase, keep in mind that you might need to tell customer support it. The agent for my gas provider got a good chuckle out of ours being “mmmcrack”
I used to just have a standard complex sentence memorized as my security question reply. No matter what question is asked, I type the properly formatted sentence, with capitalizations and punctuations in all the right places.
The question itself is useless for anyone who is trying to data mine me for access. If they don’t know the sentence I use, and exactly how it’s formatted, then they’ll never get in. I would usually just pick random questions because it doesn’t really matter.
Bonus: Most people don’t use proper punctuation, spelling, and/or capitalization online anymore. So even if they learn the sentence, figuring out how to format it correctly will pose a challenge. Unless they’re an English teacher (or a bibliophile).
My bank has us set up a verbal password to have the tellers do shit for us over the phone. They have a note in mine that if I only say the password and don’t sing it it’s incorrect. I change the lyrics/password like once a year.
deleted by creator
I just use additional passwords as recovery answers.
Username: tiddysprinkles Password: fhg@t2Gxs7... What street did you grow up on: D$pvEb4... What was your first pets name: xwDu#&8w...Like, okay, so an adversary wants to crack into my account. They’re going to need the unique email addresses for that account, my 60+ character passwords (100+ when allowed), my TOTP… Or the email, and three 60+ passwords…
At some point I’ll need to call up cs for something and answer D$pvEb4… as the street I grew up on. But it’s been a decade+ without a problem…
In which case you never need to reset a password to begin with.
Theoretically, yeah, but practically you still probably should change a password after a database breach
what would be the point of that? if you know how to and use password manager, then you already have good password you are not going to forget. what would be the point of having secondary password stored in the same database?
i had a client who was getting divorce, because “security question” to his email account was name of the parrot he shared with his wife. they were both in their 70s…
“security question” is the most stupid concept in security. here, in case you forget your password, lets just setup another password, and let it be something so trivial that 10 people already know it and another 100 can easily google or find it on your facebook.
whoever came up with it should be shot together with creator of comic sans. if a BANK demands you to setup one, you should run as far as you can from their service.
The town where you were born… Vauxhall Nova
I agree. We used my cats instead of people’s names. Like the whole extended family did I have the best cats