Posted by Brajeshwar 22 hours ago
Anyone still having doubts about this company? To be fair: the US corporations all do that. I remember how Facebook linked off-connection data together. They are all operating in the same manner here, sustaining US spy interests.
If it's ever been on there you cant trust that some long forgotten recovery pathway can't be convinced to use it to authenticate access to your account.
Phone numbers they 'verify' so you cant just put in a uniformly random 10 digit number and authenticate later through knowledge of it.
Don't do this.
I tried to do this and it turned into a very bad time with their CSRs.
The "security questions" are designed to be answered verbally. They are also designed to be "something you know" that is unlikely to be forgotten, misplaced, or change. Rather than randomized passwords, they're supposed to be something intrinsic to your life that you always remember, especially in a crisis time, and when your scribbled-down credential list is missing.
Based on imitation of a very paranoid security wonk acquaintance, I once set all these security answers to long strings of hexadecimal digits, auto-randomized by KeePass. Big mistake.
They worked for as long as I was setting them, but eventually a CSR, verbally on the phone, began to ask me what they were. The hex strings were nearly impossible to dictate over the voice connection. Also the CSR was kind of pissed about this misuse.
Security questions/answers aren't passwords. Don't subvert them into this use. Your service provider knows what they're doing. Doing this "clever" shit will only hurt yourself, and you're shooting future-you in the foot.
Another risk is that someone will call up and say "it's just a bunch of random stuff" and the customer service rep will go: "Okay, that's right, moving on..."
Or maybe to be more accurate: they do know what they're doing, recovery is a cost center so they're minimizing it. But outside of special cases with special statutory affordance (like credit card fraud) the loss is on you* if you get robbed via their weak security. So companies are intentionally minimizing their costs because you're the one that takes the cost when their security is poor.
I have encounter the pronounceable issue-- though reading 32 hex characters over the phone really wasn't *that* bad. So now-- and for the last 15 years-- I make them pronounceable passwords.
> especially in a crisis time
I've tried to organize my life so that I never need 'crisis' access to some stupid online account. I recommend it!
Or just, simply… sign in to your personal Apple/Microsoft/Google account at all?
Weird, dude.