💾 Archived View for danq.me › posts › changing-security-questions captured on 2023-04-19 at 22:34:54. Gemini links have been rewritten to link to archived content

-=-=-=-=-=-=-

I'd Like to Change my Mother's Maiden Name

2023-01-05

Following their security incident last month, many users of LastPass are in the process of cycling their security credentials for many of their accounts (If you use LastPass, you should absolutely plan to do this. IMHO, LastPass's reassurances about the difficulty in cracking the encryption on the leaked data is a gross exaggeration. I'm not saying you need to panic - so long as your master password is reasonably-long and globally-unique - but perhaps cycle all your credentials during 2023. Oh, and don't rely on your second factor: it doesn't help with this particular incident.). I don't use LastPass (I used to use LastPass, until around 2016, and I still think it's a good choice for many people, but nowadays I carry an encrypted KeePassXC password safe on a pendrive (with an automated backup onto an encrypted partition on our household NAS). This gives me some security and personalisation benefits, at the expense of only a little convenience.), but I've had ocassion to cycle credentials before, so I appreciate the pain that people are going through.

It's not just passwords, though: it may well be your "security question" answers you need to rotate too. Your passwords quickly become worthless if an attacker can guess the answers to your "security questions" at services that use them. If you're using a password safe anyway, you should either:

Answer security questions with long strings of random garbage (If you're confident that you could never lose your password (or rather: that you could never lose your password without also losing the security question answers because you would store them in the same place!), there's no value in security questions, and the best thing you can do might be to render them unusable.), or
Ensure that you use different answers for every service you use, as you would with passwords. (If you're dealing with a service that uses the security questions in a misguided effort to treat them as a second factor, or that uses them for authentication when talking to them on the telephone, you'll need to have usable answers to the questions for when they come up.)

In the latter case, you're probably storing your security answers in a password safe (You can, of course, use a different password safe for your randomly-generatred security question answers than you would for the password itself; perhaps a more-secure-but-less-convenient one; e.g. an encrypted pendrive kept in your fire safe?). If the password safe they're stored in is compromised, you need to change the answers to those security questions in order to secure the account.

This leads to the unusual situation where you can need to call up your bank and say: "Hi, I'd like to change my mother's maiden name." (Or, I suppose, father's middle name, first pet's name, place of birth, or whatever.) Banks in particular are prone to disallowing you from changing your security answers over the Internet, but all kinds of other businesses can also make this process hard... presumably because a well-meaning software engineer couldn't conceive of any reason that a user might want to.

I sometimes use a pronouncable password generator to produce fake names for security question answers. And I'll tell you what: I get some bemused reactions when I say things like "I'd like to change my mother's maiden name from Tuyiborhooniplashon to Mewgofartablejuki."

But at least it forestalls them asking me "So why did you change your surname to 'Q'?"

Links

Security incident last month

KeePassXC

Why did you change your surname to 'Q'