Twitter Porn Names Scam

http://www.pcworld.com/article/164719/security_alert_twitter_porn_names_scam.html

by coglethorpe • 17 years ago

45 25 17 years ago

raganwald2• 17 years ago

Authenticating users with passwords and "secrets" such as your hometown, high school, or first street name are all ridiculous strategies. My not-so-inner cynic suggests that banks know this but think they are safe from lawsuits as long as such methods are "industry standards."

aamar• 17 years ago

Can you suggest a better alternative?

Currently, we use email/password for authentication, but if our user forgets their password, they can answer their security questions to reset it. To design our list of questions, we worked off of http://www.goodsecurityquestions.com/examples.htm and tried to find questions which were relatively obscure, but not so obscure that users couldn't come up with answers. I suppose we can make "write your own question" an option, but we do think that most users given that option will write too easy a question, like mother's maiden name.

Our app contains a lot of sensitive data, including medical data, and privacy of this data is incredibly important to our business. We have to be attentive to regulation and industry standards -- and you're right that industry standards probably give us some cover -- but we have both the desire and the flexibility to do the right thing.

raganwald2• 17 years ago

There are no easy answers if the scenario is that someone has "forgotten" their password AND you want to authenticate them using a web form that can be submitted anonymously from an arbitrary machine.

klein_waffle2• 17 years ago

I think the banks also know that accounts are such high-value targets that criminals have better ways to steal, anyway. Straight up identity fraud is way more of a problem than account hacking.

jimfl• 17 years ago

C'mon, that porn name formulation is as old as the hills. --Duffy Kauffman.

badger72• 17 years ago

Whenever forced to use one of these authentications, I just wail on the keyboard to provide an answer. My mother's maiden name? Why, it's "sfdgh,jsdzl.kg hjsldghs,hb".

randallsquared2• 17 years ago

That's fine as long as you save it. One of my online financial sites asks for the answer to one of those questions every few times I log in.

badger72• 17 years ago

Ha! I've not come across that before. Guess I'll have to stick to something made-up but memorable from now on :(

They'll get an earfull when they ask me for it though, futile or not :)

dsingleton2• 17 years ago

Be careful doing this for a service with an offline/telecoms aspect. Both my bank and credit card companies ask to verify that information when I phone them,

eru• 17 years ago

Chances are you can just answer "I wrote gibberish." and the guy on the phone will accept that.

dsingleton2• 17 years ago

It really frustrates me when sites require a question and secret answer like "hometown" or "mothers maiden name".

Those are both very easy to find pieces of information. Let me select the question myself too. By forcing me to give you answer here you're potentially making my account _less secure_.

Right now I have standard fake answers to those questions, let's hope they never cross reference those with anything else. I'm not sure how I'd convince someone my mothers maiden name is "<insert comedy name here>"

axod2• 17 years ago

Best policy is just to use your password as the answer to these questions.

there• 17 years ago

which is stored in plaintext and often viewable by all support staff...

dhimes• 17 years ago

I use an answer which has nothing to do with the question.

saturdayplace• 17 years ago

Presumably, you're not being asked these questions if you remember your password.

Confusion• 17 years ago

I don't think any site stipulates that you answer such questions truthfully. My solution is just selecting the top secret question, but actually answering my own secret question with an answer that is as good as any password. And of course a different set of those for the actually really important sites.

jameskpolk• 17 years ago

If the site allows the user to chose their own security question, the user will find a way to render it useless. They will either input something far more trivial, or they will input something they then forget.

Personally, I don't think businesses should implement half-baked security features -- and password request forms are as half-baked as it gets.

The best solution would be for important sites (my bank, my stockbroker, ...) to make me come into their office with documentation if I forget my password.

The problem, unfortunately, gets more difficult for "unimportant" sites... frankly, short of relying on a centralized ID provider that can ensure identity in person, there isn't a good answer.

jrockway• 17 years ago

The problem, unfortunately, gets more difficult for "unimportant" sites... frankly, short of relying on a centralized ID provider that can ensure identity in person, there isn't a good answer.

I hear there's this thing called "OpenID".

s3graham• 17 years ago

"uuidgen | xsel" works for me.

bonsaitree• 17 years ago

Keep in mind these are all meant to be in-channel "back-up" strategies for when usual authentication methods fail and/or human error results in a complete loss of credentials. Forcing a true side-channel workflow for re-authentication and credential recovery isn't practical for most organizations.

A more secure, but frustrating for the dis-organized, approach is to email out a small set (3-5) of one-time credential-recovery passphrases (often called a scratch-list) with the initial account approval message.

Another slightly more usable forced-in-channel alternative includes image file recognition where the user selects from a predefined set of pictures to use as their "shared secret" when the account is created. Typically, a salted hash of the image file is stored as the actual password value so multiple versions (slightly bit skewed) of the same visual representation can be leveraged for password expiration.

Alas, all of these more secure alternatives limit the user's ability to "personalize" their shared secret and require additional bookkeeping.

tlrobinson• 17 years ago

Of course it would be just as easy to actually ask for the user's password, like many Twitter applications do...