Topic 'What is the risk of this?' in forum 'Security' - dslreports.com http://www.dslreports.com/forum/What-is-the-risk-of-this-27772612 en Sat, 18 May 2013 19:53:34 EDT Sat, 18 May 2013 19:53:34 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783714 said by AVD:

said by Blackbird:

It wasn't until there was movement in Congress to assert the privacy of SSNs that such practices faded away. But until Congress moved, no amount of rhetoric could persuade the organization or the state to change their practices.

it sorta happened overnight, except for the example I cited which happened about 3 years ago.

I can make a calculated guess @ what you were eating that day.
I'd even say how many slices you had but with much less certainty. :)]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783714 Mon, 03 Dec 2012 13:53:38 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783614 said by anon user :

I can't change the password to my account on a site with out clicking on Forgot user name and password, and then answering the security questions - even while I know the correct user name and password.

What is the security risk of that?

It's less risk than being able to change the password without having to provide the answers.

said by Snowy:

What would you hear if you asked The Teenage Mutant Ninja Turtles what is their favorite food?

Turtle soup.

--
Buckle Up. It makes it harder for the aliens to suck you out of your car.
]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783614 Mon, 03 Dec 2012 13:29:55 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783517 said by Blackbird:

It wasn't until there was movement in Congress to assert the privacy of SSNs that such practices faded away. But until Congress moved, no amount of rhetoric could persuade the organization or the state to change their practices.

it sorta happened overnight, except for the example I cited which happened about 3 years ago.
--
* seek help if having trouble coping
--Standard disclaimers apply.--]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783517 Mon, 03 Dec 2012 13:07:34 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783453 said by AVD:

and you miss my point. The trick is to answer those questions in an non obvious way.

That's ok if you often use the same unobvious way. But I find if I get too creative, it's harder to remember my lies than it is to remember the actual password, thus rendering it pointless.]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783453 Mon, 03 Dec 2012 12:51:56 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783316 said by AVD:

said by Blackbird:

said by anon user :

...That is what they do, but they only ask for: Social Security Number, Birth Date as MMDD and Last Name Including Suffix (Example Smith Jr)
So, how safe/risky is it - what they are doing?

Are you an employee of the organization? That is, is this an access portal into the company network?

My company used the full 9 digit SSN to validate initial signups to an internet based benefits portal. I think saner heads prevailed.

An organization I once was part of used SSNs for their employee ID numbers... and then put those numbers on the face of the badges. Ditto for this state using the SSN for your driver's license ID number. It wasn't until there was movement in Congress to assert the privacy of SSNs that such practices faded away. But until Congress moved, no amount of rhetoric could persuade the organization or the state to change their practices. Using a SSN for ID over the Internet is just plain wrong.
--
“The American Republic will endure until the day Congress discovers that it can bribe the public with the public's money.” A. de Tocqueville]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783316 Mon, 03 Dec 2012 12:12:33 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783249 said by Kilroy:

said by AVD:

pizza
pizza
pizza
bronx, ny

All fine until you get to the sites that require six characters in your answers and won't allow any two to be the same.

Back to the OP, the security risk is that someone who knows you well may know the answers to your security questions. This is the issue I have with this method of password resets. What is stopping your soon to be ex from hijacking your accounts and making your life a little more miserable? Forget the fact that most of these questions can be answered by using someone's Facebook page.

and you miss my point. The trick is to answer those questions in an non obvious way.
--
* seek help if having trouble coping
--Standard disclaimers apply.--]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783249 Mon, 03 Dec 2012 11:55:10 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783207 said by AVD:

pizza
pizza
pizza
bronx, ny

All fine until you get to the sites that require six characters in your answers and won't allow any two to be the same.

Back to the OP, the security risk is that someone who knows you well may know the answers to your security questions. This is the issue I have with this method of password resets. What is stopping your soon to be ex from hijacking your accounts and making your life a little more miserable? Forget the fact that most of these questions can be answered by using someone's Facebook page.
--
“Progress isn't made by early risers. It's made by lazy men trying to find easier ways to do something.” ¯ Robert A. Heinlein]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783207 Mon, 03 Dec 2012 11:46:34 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783096 said by Blackbird:

said by anon user :

...That is what they do, but they only ask for: Social Security Number, Birth Date as MMDD and Last Name Including Suffix (Example Smith Jr)
So, how safe/risky is it - what they are doing?

Are you an employee of the organization? That is, is this an access portal into the company network?

My company used the full 9 digit SSN to validate initial signups to an internet based benefits portal. I think saner heads prevailed.
--
* seek help if having trouble coping
--Standard disclaimers apply.--]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783096 Mon, 03 Dec 2012 11:22:04 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783089 said by anon user :

...That is what they do, but they only ask for: Social Security Number, Birth Date as MMDD and Last Name Including Suffix (Example Smith Jr)
So, how safe/risky is it - what they are doing?

Are you an employee of the organization? That is, is this an access portal into the company network?
--
“The American Republic will endure until the day Congress discovers that it can bribe the public with the public's money.” A. de Tocqueville]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27783089 Mon, 03 Dec 2012 11:21:00 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27782483 said by dave:

Your mother's maiden name was 'pizza' ?
You went to school at pizza high?
Your first pet was pizza?

that's the whole point isn't it?
--
* seek help if having trouble coping
--Standard disclaimers apply.--]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27782483 Mon, 03 Dec 2012 07:38:15 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27777324 As dave See Profile mentioned earlier if the challenge question answers consist of data the site already has then it's not the huge issue it would normally be seen as.

However, exchanging a password for only the challenge question answers is not too sharp, actually it's piss poor security, IMO.

Snowy-not-logged-in]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27777324 Fri, 30 Nov 2012 22:28:37 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776826 said by Snowy:

said by dave:

I now suspect this might be a troll.

The OP could post the site address to prove otherwise but I'm doubting the site exists.

It is at »ws1.aholdusa.com/jgpromos/homeac···dex.html

I can not for security reasons tell you the answers to the security questions OR give to you my account info so that you can verify, once logged in you can not change the password.]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776826 Fri, 30 Nov 2012 20:28:38 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776783 said by dave:

I now suspect this might be a troll.

The OP could post the site address to prove otherwise but I'm doubting the site exists.]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776783 Fri, 30 Nov 2012 18:45:02 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776753
I now suspect this might be a troll. Apologies if I'm accusing you unjustly - but really, do you have to ask about using your social security number as identification? (Unless, perhaps, this is some financial web site where they have that data anyway; but you're not giving a lot of detail, which helps me suspect trolling).]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776753 Fri, 30 Nov 2012 18:35:31 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776726 said by dave:

The lesser risk depends on how the forgot-my-password mechanism is arranged. If they give you a new password right there in exchange for questions of the mothers-maiden-name variety, it's not particularly secure: such data can be found out.

That is what they do, but they only ask for:
Social Security Number, Birth Date as MMDD and Last Name Including Suffix (Example Smith Jr)

So, how safe/risky is it - what they are doing?

Thanks]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27776726 Fri, 30 Nov 2012 18:27:24 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27774262 Try to switch on other secured options available on the web, it would be more convenient for you then.]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27774262 Fri, 30 Nov 2012 04:02:32 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27773805 http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27773805 Thu, 29 Nov 2012 22:10:53 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27773705 You went to school at pizza high?
Your first pet was pizza?]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27773705 Thu, 29 Nov 2012 21:43:55 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27773132 said by anon user :

What is the security risk of that?

On the other side of that...
It adds a layer of authentication, as in a 2 factor challenge if it's in addition to just using a registered email address to send a password token.

Using a hijacked email account to get access to different password protected sites is a daily occurrence.
This policy would eliminate or at least slow down an account hijacking depending on the strength of the security challenge Q & A's.]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27773132 Thu, 29 Nov 2012 18:34:06 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27772708 pizza
pizza
bronx, ny]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27772708 Thu, 29 Nov 2012 16:46:58 EDT Re: What is the risk of this? http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27772641
The lesser risk depends on how the forgot-my-password mechanism is arranged. If they give you a new password right there in exchange for questions of the mothers-maiden-name variety, it's not particularly secure: such data can be found out. If they mail you a link to reset the password, it's a little better: someone needs to intercept your mail as well. ]]> http://www.dslreports.com/forum/Re-What-is-the-risk-of-this-27772641 Thu, 29 Nov 2012 16:30:45 EDT What is the risk of this? http://www.dslreports.com/forum/What-is-the-risk-of-this-27772612 Forgot user name and password, and then answering the security questions - even while I know the correct user name and password.

What is the security risk of that?

Thanks]]> http://www.dslreports.com/forum/What-is-the-risk-of-this-27772612 Thu, 29 Nov 2012 16:24:32 EDT