Boost security to those online "Secret Questions"
To add an extra layer of online security and verify a legitimate user who has forgotten a password, many websites now require answers to “secret questions"; your password and answers to those security questions that websites figure only a real user would know.
Face it, any hacker can find the answer at government offices that post birth records and marriage licenses online to the classic “What’s your mother’s maiden name?”
Then consider some other common offerings: Your pet’s name? Your favorite color? The make or model of your first car? The city where you were born, street where you lived, or name of your high school? A recent study by Microsoft Research indicates that answers to such questions are easily sucessfully guessed almost 20 percent of the time!
Invent obscure answers to really boost security when given a menu of weak secret questions. • Pick the hometown of a relative instead of your own. • Use symbols and numbers, such as “At3lan&ta” as opposed to “Atlanta.” • Make it up: Zebulon or Funkytown aren’t foolproof, but they are harder to guess than Cleveland or Seattle. • Instead of using your childhood street name, use that of your grade-school best friend who lived on the next block. • Instead of picking “orange” as your favorite color, use “cantaloupe,” “melon madness,” “autumn dusk” or other hacker-resistant hues. For inspiration (and an easy-to-file answer), get a free sheet of “color chip” samples in the paint department of your local home improvement center.
Some, but not all, websites allow you to choose your own secret questions. Try to pick your own question. • What were the first and last names of your first boyfriend or girlfriend? (Avoid current spouses.) • What was the phone number in your childhood home? (Unless it’s also your current number.) • What was your favorite place to visit as a child? (A museum or zoo is stronger than a vacation spot.)
Read related news: "Chat-in-the-Middle" Phishing Attack Attempts to Steal Consumers' Data via Bogus Live-Chat Support by RSA FraudAction Research Lab, 9/16/2009
 |