logoalt Hacker News

ButlerianJihadtoday at 8:23 AM2 repliesview on HN

This may lead to unintended consequences.

Passwords are "protected content" that may be hidden in a web form, but usernames are not. Your username won't be routinely hidden by any ordinary password manager.

You may have difficulty when the need arises to share a long string of random digits with another human, or in writing. This may not ordinarily be a thing if more LLMs and chatbots are doing customer service, but if it's a government service, one day we find ourselves at a field office speaking with a civil servant at a window that is armored with Plexiglas, and nobody has a pen to write with, or scratch paper.

One of my colleagues said he was so clever that all his "security question" answers were random hex strings. So I imitated him, and it was very easy with the KeePassXC password generator parameters to generate a hex string of 32 characters, and so "my first grade teacher" was 0xf7a83392b12b1029ac3be7e029acbe7e; my "favorite color" was 0xa83392ac3be7e029acbe7f7a83392b17, etc.

This turned comical because security questions are particularly designed to be asked and answered in human conversations. Over the phone, the pharmacy CSR was not amused, and I lost a few accounts thanks to this ultra-paranoiac attitude and activity.


Replies

Symbiotetoday at 12:42 PM

It's in addition to the existing security.

My username doesn't fit in the web form. Instead of seeing "Symbiote" (which can be read and remembered immediately) someone sees "Sym-065c7d6c-e0b3-4d——" with half of the random characters not visible.

People in Denmark are expected to use this system to authenticate money transfers and to digitally sign documents (e.g. buy a house!).

My investment account allows up to 5,000,000DKK (€670,000) to be transferred with this digital signature.

raverbashingtoday at 9:29 AM

> and I lost a few accounts thanks to this ultra-paranoiac attitude and activity.

Sorry, but it's obvious to most people that you shouldn't just add a bunch of numbers here

If you want to trick the system, give a different (but believable) answer

In a world where some companies still think mother's maiden name is something difficult to find, give a "wrong" or "tricked" answer

(guess I just recalibrated my 'tism gauge)

show 1 reply