Bonus-rage if the exploitable "recovery" path relies on "Security Questions" you cannot change which are not-really-very-secret and which overlap with the same questions recorded (and leaked) by other companies.

▲

nullc 2 hours ago | parent [-]

At least those you can turn into covert password fields because they cannot verify them.

Phone numbers they 'verify' so you cant just put in a uniformly random 10 digit number and authenticate later through knowledge of it.

▲

ButlerianJihad an hour ago | parent [-]

> At least those you can turn into covert password fields because they cannot verify them.

Don't do this.

I tried to do this and it turned into a very bad time with their CSRs.

The "security questions" are designed to be answered verbally. They are also designed to be "something you know" that is unlikely to be forgotten, misplaced, or change. Rather than randomized passwords, they're supposed to be something intrinsic to your life that you always remember, especially in a crisis time, and when your scribbled-down credential list is missing.

Based on imitation of a very paranoid security wonk acquaintance, I once set all these security answers to long strings of hexadecimal digits, auto-randomized by KeePass. Big mistake.

They worked for as long as I was setting them, but eventually a CSR, verbally on the phone, began to ask me what they were. The hex strings were nearly impossible to dictate over the voice connection. Also the CSR was kind of pissed about this misuse.

Security questions/answers aren't passwords. Don't subvert them into this use. Your service provider knows what they're doing. Doing this "clever" shit will only hurt yourself, and you're shooting future-you in the foot.

	▲	nullc 24 minutes ago \| parent [-]
		They don't know what they are doing if they have those questions. I've found mine in multiple data breaches. If they were real they'd broadly grant access to every account. Or maybe to be more accurate: they do know what they're doing, recovery is a cost center so they're minimizing it. But outside of special cases with special statutory affordance (like credit card fraud) the loss is on you if you get robbed via their weak security. So companies are intentionally minimizing their costs because you're the one that takes the cost when their security is poor.* I have encounter the pronounceable issue-- though reading 32 hex characters over the phone really wasn't that* bad. So now-- and for the last 15 years-- I make them pronounceable passwords.* > especially in a crisis time I've tried to organize my life so that I never need 'crisis' access to some stupid online account. I recommend it!