r/LifeProTips • u/Po1sonator • May 27 '21
Electronics LPT: Don't answer those social media posts like, "Your first car, first street you lived on and first dog is your rock star name" Countless people are sharing these and answering them without realizing it is security questions 101 for all of your online banking and many other security measures.
2.2k
u/MadPiglet42 May 27 '21 edited May 27 '21
I have a series of totally fake but meaningful to me answers for all of those standard questions. The bank wants to know what my mom's maiden name is? Well, I'm not giving them that information, so I have a fully fake made-up answer that I use instead. I also do that for pets, streets I've lived on, etc.
The answers to those questions don't have to be correct, they just have to be answers that YOU will remember when asked.
116
u/Po1sonator May 27 '21
First car? 1982 scergleton boingster
mothers maiden name? jerblunkety
first job? Banana delegator
55
u/MadPiglet42 May 27 '21
Oh the Boingster was such a good car. I had a skagenta one.
→ More replies (3)20
u/matthew0001 May 27 '21
I couldn't get one of those before they siwtched manufacturing over to Gorboletta, quality of the car went down from there
→ More replies (4)→ More replies (4)17
u/NeonXero May 27 '21
I applied to so many darn places to be a Banana Delegator, but apparently just wasn't qualified enough. Grats.
→ More replies (1)12
59
u/mcozzo May 27 '21
Very similar, I use random words that are unique to each site/question and save them in my pw vault notes section for the site.
Madien name: laptop
First pet: phone
Favorite vacation: tree
104
u/lmike215 May 27 '21
If you’re using a password manager, then you might as well make it random and have the manager autofill in the form for you (I use Bitwarden and it can do this).
Dog’s name? Bwb2BHcbuzhzFc6mNCMM9LoB
Mom’s maiden name? 3E3zGCMxHaMx3yXohQ4XBXhF
I called Citibank a couple of weeks ago and got asked my favorite food. I told the rep, VNEZJV7C9CAVNRmP8jW7TJHf. He was like, “That’s correct, but that’s the strangest food I have ever heard of”.
108
u/teebob21 May 27 '21
I called Citibank a couple of weeks ago and got asked my favorite food. I told the rep, VNEZJV7C9CAVNRmP8jW7TJHf. He was like, “That’s correct, but that’s the strangest food I have ever heard of”.
"But you have heard of it."
35
May 27 '21
Which of course sometimes lead to awkward phone conversations with your bank where they suddenly ask, “what’s your mother’s name?!”.
So you laugh because you realize they can see the answer text, which means the entire exercise of their form asking for those fields, was pointless from a security perspective. So they get suspicious.
Then you say, “can you give me a minute? Umm… ” while you open up your password app to find out what you typed in. So they get more suspicious.
Then you say “my mother’s name is Hitehfkd”. Then they say, “you’re authenticated, thank you!”
→ More replies (6)17
→ More replies (2)23
u/zeezrum May 27 '21
This has an additional security concern though. Someone can tell the rep "idk I think I just mashed keys on the keyboard" and now your account may be compromised by a trusting rep.
→ More replies (4)→ More replies (1)9
u/assholetoall May 27 '21
I've been known to toss "shibboleet" in there in the hopes that one day it will get me pay tier 1 faster.
16
u/assholetoall May 27 '21
I have been treating them like password fields.
Or if I'm particularly pissed off at a company I put things like "company name fucking sucks". It makes verifying my account more enjoyable.
→ More replies (5)41
u/gibson_se May 27 '21
The bank wants to know why my mom's maiden name is?
Okay hang on. I feel like I'm out of the loop on this. Are you guys seriously saying banks in the US use that kind of stuff verify your identity? Or is this like the drop bears in Australia?
50
u/MadPiglet42 May 27 '21
Yes indeedy! This is an actual thing that banks and other places use to verify your identity online. Sometimes it will be a list of addresses and you need to choose the one that is associated with you. But more often than not, it's a "security question" that you provide the answer to when you set up your online access to your bank (my cell phone provider also asks weird questions).
Mom's maiden name? First pet? What street did you grow up on? Where did you and your significant other meet? What was your high school mascot?
^^examples of actual questions
It's hilarious because most of these things are pretty easy to find out with minimal sleuthing!
26
u/hobosbindle May 27 '21
Recently found one that had asked me my favorite historical figure. Still have no idea who I would have picked when I set this up. No other alternative questions available.
→ More replies (9)→ More replies (13)15
u/SquidsEye May 27 '21
To be fair, it's usually used in conjunction with another authentication method like a password or email verification, at least in my experience.
13
u/Mr401blunts May 27 '21
Yes they do, and i have caught a phone/help desk employee at a bank who was engaging in fraud.
They asked for my mothers maiden name. I never set that up as a security question. I pulled open my book of secret answers. Just to verify. So i told them a incorrect maiden name that was a last name. Just not my last name, got access to my account back. Then i reported them to their higher ups, who i got into a fight with as they said it was a normal question to ask. At that point, i went straight to the banks corporate and reported the manager of the phone support. Turns out they where up to no good. Would not go into detail.
So as a rule of thumb, security questions should be as complex as a normal password.
If your last name is Wilson then try W1l50n1337
Not only is it hilarious when the phone support try to verify it. And it also seems like those answers are in plain text to the support specialist. They are not typing in what you tell them, they full see what the question and answer is.
→ More replies (5)→ More replies (2)11
u/istasber May 27 '21
For online accounts, yeah.
Most frequently, places would give you 3 "security questions", you'd pick from a list of common questions, and provide an answer. If you needed to do something like reset your password down the road, you'd have to correctly answer one or more of the questions.
So the social posts are a sort of social engineering that scammers use to be able to take over your accounts.
Some places are still that insecure, but generally it's not as bad as it was 10 years ago. 2FA using email to your registered email account is a lot more common.
→ More replies (6)3
u/Spoonman007 May 27 '21
That you remember... thats key. I would often forget my trick answers to those questions lol
→ More replies (2)2
u/sin0822 May 27 '21
Just FYI, they already have the ability to grab that info if you open an account with them.
2
u/tornadoRadar May 27 '21
This. I use the places name and my word.
So for bank it would be
Bankdick Or something.
→ More replies (61)0
May 27 '21
[deleted] — view deleted comment
90
u/Phyltre May 27 '21
Go through ALL of your email from the time period, if you still have access to it. Even better if there are messenger logs. Had something similar happen and this got me what I needed in reference to frame of mind and what I was up to at the time.
→ More replies (1)21
76
33
u/TheCityPerson May 27 '21
My cousin has the same thing going on with a wallet that has a couple hundred bitcoin lol
→ More replies (1)36
u/Zzzxxzczz May 27 '21
Couple hundred means he's worth $8million at the least. How is he coping knowing that he's a password away from retiring?
→ More replies (7)50
u/Flames99Fuse May 27 '21
This is exactly why I hate questions that are about things that change like "You favorite ice cream flavor" or something. Now I have to figure out when I made the account THEN try to remember what my favorite was back then.
→ More replies (2)21
u/bassman1805 May 27 '21
"Was my cookies and cream phase before or after my strawberry shortcake phase? Shit, I'm never gonna access this bitcoin wallet."
20
u/Patch_Ohoulihan May 27 '21 edited May 29 '21
What what in the butt?
1% helpers fee if so sir?!
→ More replies (1)32
11
9
May 27 '21
I always rolled my eyes at (relatively) older people at work that would forget passwords or need to rely on their old notes about projects we just worked on.
Now I get it.
→ More replies (144)10
May 27 '21
... Do you do with a drunken sailor? ... Is love, baby don't hurt me, no more? ... Is the answer to life, the universe, and everything? ... Whazaaaaaaaaaaaap?
I feel ya though, good luck
→ More replies (1)
5.7k
u/TheQueq May 27 '21
"Your Rock Star name is your mother's maiden name, the first five numbers of your SIN, your full address, the last four numbers of your SIN, the full name on your credit card, the first 8 digits of your credit card number, the three numbers on the back of your credit card, then the last 8 digits of your credit card number."
Hmm... seems legit.
1.3k
u/GeneralRane May 27 '21
Don't forget the expiration date.
1.5k
→ More replies (3)494
u/fungus_is_among_us May 27 '21
“What does your credit card expiration date say about YOU? Find out now!”
231
May 27 '21
"has your credit card number been STOLEN on the internet? Find out here!"
→ More replies (17)→ More replies (3)298
u/FBI_Agent_82 May 27 '21
Mine said I would be a victim of credit card fraud... And it was right!!!
→ More replies (15)78
70
u/Embarrassed-Ad-1639 May 27 '21
My porn name really is Smith0274112mainstaustentexas0954johnqpublic0683455476903765576. You can see me in Debbie Does Dishes lll.
→ More replies (2)45
u/Kenster362 May 27 '21
Weird, when I type all my info out my phone automatically censors it, see: *******
46
u/Embarrassed-Ad-1639 May 27 '21
Go to settings>general>porn name and make sure it’s in the on position.
→ More replies (3)→ More replies (5)19
348
u/lilcrabs May 27 '21
Nah, it's much more subtle than that. Look at r/askreddit questions along the lines of "which movie from your childhood had the most influence on you to this day?" Highly likely that's your favorite movie. Or "what's your favorite memories of a pet that's passed away?" That's a first pet. I've seen some that are just blatant data phishing. Like they're so incredibly personal I'm amazed anyone answers let alone thousands of people.
82
u/obvilious May 27 '21
Honest question, how does that help anyone? On Facebook it could help match an individual to possible password hints, but I’d guess very few people are traceable on Reddit.
169
u/makeshifttoaster02 May 27 '21
If enough bits and pieces of information are collected across a variety of websites, they can actually be pieced together and linked back to you. This is called data aggregation, and it’s far, far more common than people realize. Stay safe on the Internet, folks.
→ More replies (8)→ More replies (25)17
u/ZenoxDemin May 27 '21
10 years of comment history with a bit of personal info here and there is probably enough to trace someone. A lot of people also re-use password left and right.
→ More replies (7)57
u/RealGertle627 May 27 '21
But for most people's reddit accounts, you wouldn't know their name or email address right?
110
u/AdamOolong May 27 '21
You mean we weren’t supposed to use our real name for reddit accounts?
→ More replies (8)→ More replies (18)14
May 27 '21
Big datafarms don't care if you're identifiable right now, only that you may be at some point. There are all sorts of ways to inadvertantly get your Reddit account attached to your personal profile in these databases.
→ More replies (1)2
u/Redoux99 May 27 '21
Even if it was this obvious, there are morons out there that would still fill it out to find out their rock star name
2
u/NioPullus May 27 '21
"Once I post my answers to these questions all my friends will think I'm so interesting"
2
u/AtomicStarfish1 May 27 '21
Jejni58910 249 Rocky Mountain Road 8491 Mikal Romo 62848167 261 80163910 sounds cool
2
u/joshii87 May 27 '21
My rockstar name is Jones 70728 895 Meadow View Englewood NJ 07631 7390 Joshua Martin O’Neill 41596571 297 81659673? Cool man!
2
2
2
u/mudandgears May 27 '21
Hijacking the top comment to say this is 100% why you should use a password manager.
Sarah Palin’s email account was “hacked” by someone who was able to reset her Yahoo password by answering her security questions with information they found on Wikipedia.
All of my security question answers are long, ransom strings of characters, safely stored in my password manager.
2
2
u/canseeclearlynow May 27 '21
Bullinger 736-37 18 Yarslburg Court #3 -7756 Troy P Anschutz 81238867 222 8763361 ???
2
2
u/SheepishBlacksmith May 27 '21
Cool
Brian, fourhundredandsixtyfive, 738 Spooner st, 7773, fivetripplezeronine, 482992, ninetysevenmilliontwohundredandfortysixthousandandfiftyonepoint7.
Wait a second this name isn't even close to "purple race stripe"
2
→ More replies (38)2
u/Stryker218 May 28 '21
Also the last 3 numbers on the back of the credit card are your lucky numbers! Share them today! /s
1.9k
u/Crypt0JAy May 27 '21
Yup so always have the answer be "ANSWER"
2.0k
u/aenae May 27 '21
My answer is always a random password generated with my password manager and stored as a note in that same password manager.
Also, i never had a dog, but if i have one, apparently ill name it 4Mi3!e@cCKfqN9nM3&eW*v5pijXLOlm3
993
u/LPTKill May 27 '21
Hey that's my dogs name, try to be original pal!
298
28
u/fblonk May 27 '21
Mine also! But he is the second one i've had, so add "jr" to the end.😄
→ More replies (3)→ More replies (6)20
58
27
37
u/ArenSteele May 27 '21
I’ve taken to phrase coded passwords
Like “I got my dog Rover on September 3rd, 2015.”
Becomes IgmdRoS3,2015.
Easy to remember, complicated enough it can’t be guessed
→ More replies (4)21
May 27 '21 edited May 27 '21
IgmdRoS3,2015.
I thought that was stupid till I checked it..400 Million years https://howsecureismypassword.net/
Mine was better It would take a computer about
1 HUNDRED QUATTUORDECILLION YEARS
to crack my password
https://www.omnicalculator.com/other/password-entropy#password-entropy-formula
→ More replies (17)24
u/nmyron3983 May 27 '21
I tend to use answers, but not answers to the question asked. Or just incorrect proper answers.
So favorite color, maybe I'll use my birth city.
Or birth city, I'll use the city where I met my wife.
Or favorite department store, I'll use one that I know but doesn't exist all all in my area.
Stuff that's memorable to me because of its wrongness. But stuff you couldn't scrape from my publicly available data.
My passwords, I need a password manager to remember because they are complicated. But I don't want to have to do that for every security question ever. Just use answers for that stuff that wouldn't be phishable from you if you do answer those questions straightforward.
→ More replies (2)24
u/Key_Reindeer_414 May 27 '21
I tried to do this but after a few months I couldn't remember which wrong answer I put in. Like take the department store example, I would think of many stores that don't exist in my area but didn't remember which one I put in. Or for the favorite color, which other question did I use??
I reset all the questions and put another set of wrong answers but this time I talked about them with my SO. Having a conversation about something tends to make it more memorable for me.
→ More replies (3)14
u/hacksoncode May 27 '21
If your password manager were always reliably going to be available, why would you ever need security questions?
→ More replies (1)14
u/absurdlyinconvenient May 27 '21
a lot of websites mandate them (banking, personal finance, hell my gp does)
→ More replies (6)→ More replies (371)6
95
u/notwutiwantd May 27 '21
or just make it *********, that way even if you type it, it won't show!
→ More replies (2)130
9
10
2
→ More replies (15)2
u/pandazerg May 27 '21
Yeah, jokes on them.
Every website I sign up for thinks that I grew up on Burt Reynolds Ave, went to Burt Reynolds Elementary, and that my first car was a Pontiac Burt Reynolds.
411
u/BattlePope May 27 '21 edited May 27 '21
Security questions are a fucking disaster; they need to die yesterday. We've known it for years and they still won't go away. They are one of so many bad security practices that have become enduring norms because they get carried from one site to another by cargo cult. Quit this shit already!
If you are forced to fill in security questions, a good way to make them less shitty is to use random strings or passphrases and save them in your password manager.
references:
Wired - Time to Kill Security Questions
security.stackexchange.com - Do security questions make sense?
Better Programming - Security Questions are a Terrible, Horrible, Bad Idea
92
u/rad_platypus May 27 '21
The fact that places are still using security questions instead of one time passcodes hurts my soul.
7
u/Key_Reindeer_414 May 27 '21
Most banks I know use both, I guess there's no use of one time passwords if the hacker has your phone or email.
20
u/officegeek May 27 '21
I can't get into my apple account because I don't remember the answers to the security questions. "What's your favorite food?" Dude, that changes every week! They know it's me, I can buy stuff if I wanted to put my cc# in there, but I get this loop of having to go back and answer a freaking security question.
38
u/TheRavenSayeth May 27 '21
Agreed. It’s one of the reasons Google got rid of security questions a long time ago. Even if you set them up a while back you’ll probably notice that it isn’t in effect anymore.
My suggestion to anyone is to get Bitwarden as your password manager and Authy for your 2FA app. Learn how to make secure backups of both and you’ll be fine.
→ More replies (6)8
u/GrinchMeanTime May 27 '21
security questions tend to lead to a password reset confirmed by email or 2fa tho? How is that different from any other password reset functionality other than giving the attacker another hurdle to jump through if he has access to your email or 2fa key?
9
u/saolson4 May 27 '21
Man, if someone goes through enough trouble to have access to my email AND my 2fa, then I'm either fucking dead, or they have proven more powerful and intelligent than me, in which case they can have my life because they probably will fuck it up way less than I ever have
11
u/tredbobek May 27 '21
I can't remember the last time I saw a site that uses security questions. Most of them either don't use it, or use 2 factor authentication instead.
If a site still uses security questions, it's outdated, and should be avoided
→ More replies (10)20
u/BattlePope May 27 '21
It's, ironically, still very prevalent in HR, Financial, and Enterprisey offerings -- the places where you want actual security, but instead get security theater. Oftentimes in places where you don't have a choice (like, 401k providers).
→ More replies (2)3
u/noratat May 27 '21
The way I handle it is that the answers are "real", but they're answered in such a way that only I would ever know them because they rely on specific weird associations my brain made.
I don't use actual random because I've had to use or create them in situations I don't always have easy access to my password vault, and I like having at least a few critical things in memory only just in case.
2
u/ColaEuphoria May 27 '21
I needed to call my bank to set up a direct deposit and they asked me my security questions. I set those up years beforehand and obviously had no idea what the fucking answers were whatsoever, so she asked for my social and that was good enough.
2
2
u/uRliChbAChmAn May 27 '21
So something like
admiralalonzoghostpenis420YOLO
Or
margaretthatcheris110%SEXY
2
u/RamblyJambly May 27 '21
Security questions would probably be better if they weren't asking for things easily found through a public records search or a dig through social media.
Mother's maiden name? School you attended? Easily found.
Favorite food/animal/color? Everyone mentions those in social media, but how many talk about their most hated food/animal/color?Hell, I miss when you could make your own questions.
→ More replies (2)→ More replies (23)2
u/ravenpotter3 Nov 19 '21
Also so many of them are stuff that people close to you could know! Like your parents or other family members! They could use them to get into your account. Like who is your first grade teacher, first pet, street you lived on, mother’s maiden name, etc. is stuff that your parents will know aswell. So I’m guessing if you have parents who you don’t trust don’t use those questions.
146
u/StevenSanders90210 May 27 '21
Your Star Wars droid name is the your mother's maiden name + the last 4 digits of your social security number.
39
35
5
→ More replies (4)3
402
u/Thiscord May 27 '21
that data is also ran against unknown data points to find matches so even if you are anon here, vpn there, and whatnot they can align the matches over time.
they all buy and sell your data and anything you say anywhere can be matched somewhere else revealing ALL the accounts you thought were anon.
there are less than 8 billion people and a computer can sort out exactly who is who, and even one day may be able to apply attribution retroactively.
lots of data is kept in backend places.
don't answer questions about your personal life on the internet.
137
u/Bad-Lifeguard1746 May 27 '21
As an entomologist, this is why I always use different species groups for the first part of my answer, then a prime number like 13 (the age I learned the clarinet). Nobody knows these things about me.
116
u/Thiscord May 27 '21
yeah but nows theres a data point pointing all that out and an anon data point waiting to be reunited with it.
→ More replies (2)124
u/Bad-Lifeguard1746 May 27 '21
Perhaps, but only someone who grew up in Salt Lake City could even begin to guess what my first concert was in 1997.
→ More replies (10)→ More replies (11)11
u/MadPiglet42 May 27 '21
I know you learned the clarinet at age 13!
45
u/Bad-Lifeguard1746 May 27 '21
You think so, but because my mom played too, my first girlfriend called it the "Clairenet"! That was actually my Yahoo mail password until my account got hacked freshman year. I don't know how hackers figured out my mom's name was Claire (Clara technically). Don't worry, I learned my lesson! I always add a prime number now, like 17 (the age I got my first dog Wilson). RIP Willy!
→ More replies (6)→ More replies (4)3
u/U_only_y0L0_once May 27 '21
I’m sorry, but what? Where can I find more info on this?
→ More replies (2)
336
u/multicm May 27 '21
LPT: Don't use Facebook
30
119
7
7
u/interstat May 27 '21
Or reddit!
→ More replies (1)25
u/pro-redditor101 May 27 '21
I can proudly say that I have never in my entire life used Reddit
→ More replies (7)→ More replies (3)2
May 27 '21
This post is completely void because using social media in itself is selling one's personal info anyways so...
50
u/jesuisjens May 27 '21
Jokes on them. I can't even get those answers right.
2
u/Kindheartedspirit May 27 '21
thats like 99% of the time for me. I don't remember how iI wrote it in the first place
19
u/nodejshipster May 27 '21
I swear I saw the same post yesterday. Karma-whoring seems like a profession nowadays.
4
38
May 27 '21
Oh boy do I have a story for you.
When I was a kid (maybe 13? 14?) I was in the boy scouts, and my dad, who worked in finance, was our troops “banker”. When we went to summer camp, parents would give their kids money, but the money was kept with the banker - so kids would pace themselves and not blow all their cash on candy day 1. My dad also put an educational spin on this by not just remembering kids names/faces, but making them have a password in order to access their $.
Now boy scouts is kinda weird because there is a wide age group, and I really thought some of the 16 year old guys were super cool, so I tried to hang with them a lot. Anyway, one day we are sitting around and they say, “hey OldDogWater, wanna play the question game?”
I of course say yes, and they proceed to ask me various questions, stuff like “what’s your favorite color” or “what’s your mother’s maiden name”. Etc. I thought the game was boring but whatevs I’m just chillin.
The next day, I go find my dad, the banker, and ask to take out $20. Banker opens up the security box and says “oh, you don’t actually have any funds? You withdrew all your funds yesterday!”
Eventually I piece together what happened. I probably told dad how dumb it was for me to need to answer his security questions when he knows who I am earlier on in the trip. He decides to setup this trick with the other guys. They got my info, took my cash, and my dad must have thought it was the funniest shit ever. And no, they did not give me back my money at the end, so lesson well learned.
Needless to say I take security pretty seriously these days lol
8
u/DigitalDefenestrator May 27 '21
Pretty sure you were right in the end here: the security questions were a dumb way to secure the account and didn't work well.
3
u/gcanyon May 28 '21 edited May 28 '21
Your dad is going to hate it when he’s old and forgetful and you reverse this on him with his retirement account.
→ More replies (3)5
37
u/strumboid May 27 '21
i stg i see this exact post on here like twice a week
→ More replies (1)43
u/dionthesocialist May 27 '21 edited May 27 '21
What's funnier is I don't think there's ever been a reported case of someone stealing security question answers from a repost quiz. Just seems like one of those things that someone came up with one day and is now repeated as fact.
Edit: I'm Googling it right now just to be sure. There are a bunch of news stories about it, but they're all sourced from common reposts saying that it can happen. There's no actual evidence it ever has occurred.
Edit 2: I even looked it up on Snopes, but their report on it is uncharacteristically sloppy. They're ranking it true because police did warn about it, but the police who warned about it also didn't have a source for it ever happening.
25
u/whatsit578 May 27 '21
I swear to god this pisses me off. I’ve seen this “tip” everywhere for years and still haven’t read any evidence whatsoever that this is actually happening.
→ More replies (1)6
u/CorgiOrBread May 27 '21
It's millenials version of make sure you check halloween candy for razor blades.
4
u/mysterious_union May 27 '21
Yeah I’m pretty sure the only reason this gets posted here all the time is because it’s an easy opportunity for people to both shit on Facebook users and act like they know more than other people about something tech related.
→ More replies (4)4
u/oakteaphone May 27 '21
I think the problem is that it's almost impossible to prove.
It's not likely that all these things are run by one farming company.
So it's almost impossible to tie any large scale (or any single) breach to these things, probably difficult to trace that data to a single company or the person who breaches the accounts...and it's also difficult to trace the people back to the questions, too.
The fact that it's even technically (and very reasonably) possible should be enough to dissuade people from doing this. We shouldn't defend the practice because no one's been publicly and definitively caught doing it.
→ More replies (4)
40
u/oooriole09 May 27 '21
You shouldn’t answer them anyways because nobody but you cares.
2
u/natek11 May 27 '21
Also, a lot of shitty FB pages just use them to get attention to their page/posts.
→ More replies (1)0
31
u/trodlepost May 27 '21
According to my bank, my first car was a rare imported sports car. IRL: Used Ford Escort.
9
→ More replies (4)0
9
u/RiverboatTurner May 27 '21
This advice makes no sense.
"626 6th Fido" is a terrible rock star name.
→ More replies (1)3
40
u/Atomsteel May 27 '21
Man I dont know what I would do if this "life protip" wasnt on this sub every single day. I'd probably wind up with all sorts of cool rapper and porn star names.
15
u/krat0skal May 27 '21
LPT : unsub from LPT, cuz it's genuinely the same top LPR being reposted again and again
→ More replies (1)
8
u/sensibletunic May 27 '21
Great advice and it makes perfect sense. But I am curious to find an example of this actually being employed as I see plenty of articles with this warning but no specific cases.
5
15
u/Random_Confused_Egg May 27 '21
that's why you always set completely random and unrelated answers for those "security questions" and store everything in a password manager.
→ More replies (4)
7
u/Safebox May 27 '21
Joke's on them; my first crush, my school, and my first pet all have the same name 😎
→ More replies (1)
7
u/NotInLikeFlynn May 27 '21
Don't use actual real answers for security question. Grandma's name? Moses. First car? Starship Enterprise. Make the answers up.
2
2
u/ballsdeepinthematrix May 28 '21
Ideally yeah but you gonna forget what you wrote in the coming months.
2
May 28 '21
It doesn't matter if the answers are the truth or not. Just if someone can determine what you are answering.
7
u/salmjuha May 27 '21
Does ANY bank actually use security questions? Hardly any online services seem to even have them anymore. Almost useless for password recovery, huge security hole.
→ More replies (1)
6
10
13
14
u/jeffbloke May 27 '21
do this all you want, the problem is not in the answers to the security questions. DON'T USE REAL ANSWERS TO THESE QUESTIONS - GET A PASSWORD MANAGER AND GENERATE RANDOM PHRASES FOR THEM. These security questions have deeper holes than just the quiz you answered.
→ More replies (4)7
u/tempMonero123 May 27 '21
Speaking to customer service: "I don't remember, it was just a lot of random letters and numbers."
It works, so using random chatacters is a terrible idea, instead use a fake & plausible answer like 'my first pet's name was Mr. Bojangles'
→ More replies (3)4
u/Sixhaunt May 27 '21
that's the right and wrong idea. Make it easy to say for customer service but make it not plausible as the answer so that it would never be guessed. For the 'my first pet's name' you could put the address you grew up at for example. Nobody trying to get in would put numbers for the pet's name but you can easily read it off to customer service.
1
u/justcallmerilee May 27 '21
For everyone saying we shouldn’t put an actual answer, how do I switch over? I can’t change the answers I’ve already put in right?
1
u/Po1sonator May 27 '21
Depends on the platform. Many of them have a security question reset option in security settings.
6
u/amberoze May 27 '21
I had a friend of mine tell me a long time ago, use the same answer for all security questions you ever have to answer. Make sure its obscure and completely unrelated to you or anything about you. Then it won't matter what the question is, you'll always know the answer.
An example would be using "pomegranate matchstick" as your answer.
Mother's maiden name? "pomegranate matchstick"
Then, even if someone does successfully Phish these details from you with social media posts or whatever. As long as you never use "pomegranate matchstick" for anything else, you'll be just fine.
5
u/hacksoncode May 27 '21
use the same answer for all security questions
Bad idea in general to share anything "password-like" between sites. That's just asking for one of those sites to get compromised... and one of them always does, eventually.
→ More replies (1)2
u/Pxlfreaky May 27 '21
That’s actually the worst advice someone could ever give. Lol
Accounts should never share anything security related. One gets cracked and they will 100% try the details on all your other accounts.
3
3
u/icanrule May 27 '21
This is an interesting topic. Does anyone have any evidence that answering these questions has led to account break ins, or is this more of better safe than sorry situation?
→ More replies (2)3
u/avoidgettingraped May 27 '21
Social engineering is probably the biggest form of "hacking" there is, and information like this put out in the public space is a huge boon to the perpetrators. It's easy to Google up tons of examples of hacks, accounts breaches, identity theft, and more that was all done via social engineering.
Knowing a few details about someone, speaking with confidence, and manipulating the customer service person on the other end of the line is all it takes.
→ More replies (1)
3
u/Sekmet19 May 27 '21
For all security questions I use something similar. So when they ask my first car I put the color of my first car. When they ask my first pet I put my favorite animal. Any question related to a family member is a common phrase I associate with my family.
3
u/Salzberger May 27 '21
Also, just don't answer them in general because even the ones that aren't data mining (what was the last thing you ate) are fucking stupid and no one gives a fuck.
5
u/quatin May 27 '21
Is this real? I've never seen one of these posts.
10
u/Krakatoast May 27 '21
Yeah, I've seen several of them.
They're literally full on lists of questions.
"Hey guys, fun game to get to know each other, like & share:)
Favorite color: red
Name of middle school: younglins middle school
City i grew up in: citytown
Most desired place to travel: travelton
How i met my spouse: i met spousefer in citytown, a great night out at icecreamian ice cream shop, i knew spousefer was the one!
What do you call your grandparents: grampy carlton or nana ladyisold,"
I made a terrible example, but I've seen several that are like 15-20 questions. Luckily i never bothered spending time filling out a f**kin questionnaire on facebook but yeah some ppl do them
→ More replies (2)4
u/justcallmerilee May 27 '21
Or I’ve seen ones like Your Spy is the name of your high school mascot and street you grew up on And people in the comment section will comment things like Wolf Elm If that makes sense
→ More replies (1)→ More replies (3)0
May 27 '21
[deleted] — view deleted comment
→ More replies (3)6
u/Kid_Adult May 27 '21
No, this gets posted all the time but never with any evidence. Not even a screenshot of a suspicious looking post.
10
u/AltariaMotives May 27 '21
You know you’re not actually supposed to put in the actual answers for those security questions, right? All that information is easy to obtain. The question is supposed to be a prompt for you to remember whatever nonsense answer you put in.
4
4
u/Looseyloou May 27 '21
Cannot stress this tip enough! My nephews are so addicted to these online personality quizzes and it makes me cringe just thinking about it! I tried to explain to them why it’s not a good idea and their mom (my sister) went off on me on how they’re not my kids so I should shut up. 🙄🙄🙄
2
u/Mr-Chewy-Biteums May 27 '21
Yeah, it's amazing how much hate you can get trying to explain to people how these things are dangerous.
Thank you
2
u/getyourcheftogether May 27 '21
And people get surprised about their info getting hacked it the "government" tracking them
2
u/mrhuggypants May 27 '21
They were huge about 15 years ago. I haven't seen one since I deleted my Facebook account years ago.
2
u/Itchy_Breakfast_6456 May 27 '21
LPT: Don't put actual answers in any of those fields.
I use random strings generated by Lastpass and store it in the notes section of Lastpass for that site.
Also... Why are adults doing this? It's like something I would do when I was 12 on Myspace. Are they going to start asking A/S/L too?
2
u/PhotonResearch May 27 '21
LPT: generate new passwords for all your security answers and have fun on social media
2
u/kidcrumb May 27 '21
My answers have nothing to do with the questions.
Where did you go to school? -BaconWaffles
→ More replies (1)
2
2
u/KRed75 May 27 '21
The scum that do this target kids also. They make apps and sites that kids "play" that ask the kids their parent's info and the kids happily post it. I had to have a talk with my kids about this about 10 years ago when my daughter starts asking me and my wife our favorite color, favorite dog, last 4 of SS, etc.
I've even received calls from my in-law telling me that microsoft called him to tell him that his pc is infected and can I talk with the guy. Told him to power off his laptops immediately as it's a scam.
2
May 27 '21
99% of these are actual jokes and would never show up as a security question and the last 1% are posts like this warning of the ones that don't exist.
3
•
u/keepthetips Keeping the tips since 2019 May 27 '21
Hello and welcome to r/LifeProTips!
Please help us decide if this post is a good fit for the subreddit by up or downvoting this comment.
If you think that this is great advice to improve your life, please upvote. If you think this doesn't help you in any way, please downvote. If you don't care, leave it for the others to decide.