Hacker News new | past | comments | ask | show | jobs | submit login

Childhood phone numbers - if your parents still live in your childhood home and haven't changed phone number (not that unusual) then it's just their phone number.

First teacher - actually I can't remember mine (I was only there for a single term) but, again, I know enough people who have contacts they've had since very early school days, so will share that answer.

Honestly, I'm yet to come across a 'security' question of that type that is memorable to the user but couldn't be identified by someone else for at least a significant percentage of users. I'm not at all sure there are 'safe' questions of this sort.




We spent some time working on this for the security survey at SocialSci during signup -- since we don't associate your email to your account; its the only way for our participants to recover their password.

We did a lot of research and came up with a list of 20 security questions, tiered by quality and applicability. We present users the questions, and allow them to skip to a more desirable one.

Some highlights: Who taught you how to drive? How do you like your eggs prepared? What was your first brand of cell phone? (a cell phone is required to have gotten this far) How quickly after you were eligible did you get your drivers license? What time of day were you born? What is the name of the place your wedding reception was held?

Many of these questions are multiple choice, not fill-in-the-blank. We found that users are far more likely to recall what they would've chosen from the available choices vs what arbitrary text they entered into a field.

There are limits on recovery attempts; and limits on how much we tell you about what/how many you got wrong.

We require you to fill out 5 of these.


"Who taught you how to drive?"

So that's 60% of your users with the security answer: "Dad"


The best solution I've found: I lie on all my security questions.

Give your father's middle name instead of your mother's maiden name, or something. As long as you're consistent in your lies, it's not hard to keep track of.


This is not-super-secure, but in a lot of situations I just use a rule like "third character of first word + second character of third word + first character of fourth word", and so on. You end up with gibberish most of the time, but at least you're not going to let it slip in conversation (and as long as you remember the rule and don't pass that around, you're hopefully okay).


My strategy is to pad the real answer with the same two words for each question. For example, "purple 12345 banana", "purple Smith banana", etc. Not perfect, but it should defeat even the best would-be guessers.


Or just put "forty two" in all the answers!




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: