I’ve only used Bitwarden, so I can’t speak to the others, but Bitwarden does, yeah.
But to the average person, “password manager” is whatever their browser does for them, and I’m not sure those have much more functionality beyond username/password and ID fields.
You replied to the wrong guy, but I think they rather meant it as “unless you’re using a password manager (…because password managers are generally capable of storing extra data)”. 😅
I mean, even if it can’t store extra data in one entry, you could still create multiple entries for a single account and just name the entries similarly.
it probably doesn’t hurt to save it, but at the same time, for a keepass user, if you lost the primary password, it probably means you don’t have the wallet for whatever reason.
Well, there might be other reasons to need them. For example, I once got locked out of an account, because I had lost the 2FA credentials (which I did not have in KeePass, incidentally). The webpage let me back in with a recovery question.
Well, technically, it was a recovery code which was just random symbols I had been provided upon account creation, but kind of the same thing in the end.
that is shitty implementation. circumventing 2fa with 1fa method that can be easily intercepted is pinnacle of stupidity.
if the protected source is so important that it warrants using 2fa, then the recovery after losing it must really verify the identity and sending some random code doesn’t cut it.
another thing is the spreading of 2fa to anything where it doesn’t really need to. that is cancerous in itself.
so the funniest thing, we were sitting around at a family reunion. someone asked, so do we all use the same answers for our security questions? and uh, turns out we all do. same made up answers (everyone had the same favorite cat. whose favorite person was me awww yisss), but the same answers. and that moment we decided to update our security procedures.
the trick is q’wdsjfaosdijgoasfgnsdk;jfavfghoiaerjhpguewrhjtiwuerth
never ever put any non-random information there.
i had a 70 year old guy getting divorced, because his wife of similar age “hacked” his email by entering name of their parrot and found out he is emailing with another 70 yo lady.
Ideally you still want it to be something you’ll remember, unless you’re using a password manager capable of tracking those for you.
The mistake that guy made is that he still chose a name he had some attachment to. You want to make sure you choose something you have no attachment to whatsoever.
And then never reuse the same answer between different services, just in case one of them is storing them as plaintext.
what you are describing is password and we use wallets for these. the problem is, that various services intentionally presents “security question” as sort of a fallback for when you forget the password, because you wouldn’t forgotten your first pet’s name, right? it is fundamentally wrong approach.
what you are describing is treating the “security question” as second password, which is possible, but kinda pointless. if you have good password stored in the wallet, it is safe and you won’t forget or lose it. and if you lost it, it is probably because you lost access to the wallet, so saved security question you treated as a second password and stored in the same wallet is kinda useless now.
I’m just recommending that folks treat the answers to the security questions, at a minimum, like they treat their passwords themselves. The security questions are a way around the password, and so they should be kept just as secure and hard to guess.
If you’re using a secure password manager, great, that’s exactly the best approach. The majority of people don’t, which is where this sorta thing becomes an issue. If you have a password manager and the service you’re using forces you to answer security questions, of course you can let the password manager generate something just as random as the password itself (provided it can remember it and can track which term corresponds to which question). For anyone who does not, it’s just important to choose something you’ll remember but no one who knows details about your life can simply guess. Otherwise it doesn’t matter how secure your password is.
The security questions are often forced.
The trick is to make up answers. Have some go-tos or a pattern that only you know and no one else could guess with information from your life.
Why yes, I did grow up on AmazonFakeStreet. Oh, my spouse? MicrosoftSpouseName of course.
You can also store these in a password manager like KeePass…
KeePass is very good all encrypted data is local, and no server interaction
Doesn’t every password manager have a “notes” field these days?
I’ve only used Bitwarden, so I can’t speak to the others, but Bitwarden does, yeah.
But to the average person, “password manager” is whatever their browser does for them, and I’m not sure those have much more functionality beyond username/password and ID fields.
You replied to the wrong guy, but I think they rather meant it as “unless you’re using a password manager (…because password managers are generally capable of storing extra data)”. 😅
I mean, even if it can’t store extra data in one entry, you could still create multiple entries for a single account and just name the entries similarly.
And to give an example of a password manager intentionally kept so simple that, well, there is a solution, but it is somewhat choose-your-own-adventure: https://www.passwordstore.org/#organization
(You can get GUIs for it, which may have a premade solution after all, for example: https://f-droid.org/packages/app.passwordstore.agrahn )
if you use password manager, you should never need to use recovery questions.
Well, I’d rather write down anything I enter, in case I do ever need it. But yeah, generally speaking you shouldn’t need the answers.
it probably doesn’t hurt to save it, but at the same time, for a keepass user, if you lost the primary password, it probably means you don’t have the wallet for whatever reason.
Well, there might be other reasons to need them. For example, I once got locked out of an account, because I had lost the 2FA credentials (which I did not have in KeePass, incidentally). The webpage let me back in with a recovery question.
Well, technically, it was a recovery code which was just random symbols I had been provided upon account creation, but kind of the same thing in the end.
having 2FA in place and then letting you in based on “security question” is the peak clown show.
(this is not attack on you, but wow…)
They’s talking about 2fa recovery codes, which are specifically made for when one loses their phone, for example. And are typically random.
that is shitty implementation. circumventing 2fa with 1fa method that can be easily intercepted is pinnacle of stupidity.
if the protected source is so important that it warrants using 2fa, then the recovery after losing it must really verify the identity and sending some random code doesn’t cut it.
another thing is the spreading of 2fa to anything where it doesn’t really need to. that is cancerous in itself.
so the funniest thing, we were sitting around at a family reunion. someone asked, so do we all use the same answers for our security questions? and uh, turns out we all do. same made up answers (everyone had the same favorite cat. whose favorite person was me awww yisss), but the same answers. and that moment we decided to update our security procedures.
You get security questions asking you who your “favorite person” is?
Hmm… SELECT * FROM Users WHERE SecurityResponse2 = “*Epstein”
I bet Jesus is a popular answer.
It’s the cat, yeah
the trick is q’wdsjfaosdijgoasfgnsdk;jfavfghoiaerjhpguewrhjtiwuerth
never ever put any non-random information there.
i had a 70 year old guy getting divorced, because his wife of similar age “hacked” his email by entering name of their parrot and found out he is emailing with another 70 yo lady.
Ideally you still want it to be something you’ll remember, unless you’re using a password manager capable of tracking those for you.
The mistake that guy made is that he still chose a name he had some attachment to. You want to make sure you choose something you have no attachment to whatsoever.
And then never reuse the same answer between different services, just in case one of them is storing them as plaintext.
what you are describing is password and we use wallets for these. the problem is, that various services intentionally presents “security question” as sort of a fallback for when you forget the password, because you wouldn’t forgotten your first pet’s name, right? it is fundamentally wrong approach.
what you are describing is treating the “security question” as second password, which is possible, but kinda pointless. if you have good password stored in the wallet, it is safe and you won’t forget or lose it. and if you lost it, it is probably because you lost access to the wallet, so saved security question you treated as a second password and stored in the same wallet is kinda useless now.
I’m just recommending that folks treat the answers to the security questions, at a minimum, like they treat their passwords themselves. The security questions are a way around the password, and so they should be kept just as secure and hard to guess.
If you’re using a secure password manager, great, that’s exactly the best approach. The majority of people don’t, which is where this sorta thing becomes an issue. If you have a password manager and the service you’re using forces you to answer security questions, of course you can let the password manager generate something just as random as the password itself (provided it can remember it and can track which term corresponds to which question). For anyone who does not, it’s just important to choose something you’ll remember but no one who knows details about your life can simply guess. Otherwise it doesn’t matter how secure your password is.