I'D LIKE TO CHANGE MY MOTHER'S MAIDEN NAME
2023-01-05
Following their security incident last month, many users of LastPass are in
the process of cycling their security credentials for many of their accounts
(If you use LastPass, you should absolutely plan to do this. IMHO, LastPass's
reassurances about the difficulty in cracking the encryption on the leaked
data is a gross exaggeration. I'm not saying you need to panic - so long as
your master password is reasonably-long and globally-unique - but perhaps
cycle all your credentials during 2023. Oh, and don't rely on your second
factor: it doesn't help with this particular incident.). I don't use LastPass
(I used to use LastPass, until around 2016, and I still think it's a good
choice for many people, but nowadays I carry an encrypted KeePassXC password
safe on a pendrive (with an automated backup onto an encrypted partition on
our household NAS). This gives me some security and personalisation benefits,
at the expense of only a little convenience.), but I've had ocassion to cycle
credentials before, so I appreciate the pain that people are going through.
It's not just passwords, though: it may well be your "security question"
answers you need to rotate too. Your passwords quickly become worthless if an
attacker can guess the answers to your "security questions" at services that
use them. If you're using a password safe anyway, you should either:
* Answer security questions with long strings of random garbage (If you're
confident that you could never lose your password (or rather: that you could
never lose your password without also losing the security question answers
because you would store them in the same place!), there's no value in security
questions, and the best thing you can do might be to render them unusable.), or
* Ensure that you use different answers for every service you use, as you
would with passwords. (If you're dealing with a service that uses the security
questions in a misguided effort to treat them as a second factor, or that uses
them for authentication when talking to them on the telephone, you'll need to
have usable answers to the questions for when they come up.)
In the latter case, you're probably storing your security answers in a
password safe (You can, of course, use a different password safe for your
randomly-generatred security question answers than you would for the password
itself; perhaps a more-secure-but-less-convenient one; e.g. an encrypted
pendrive kept in your fire safe?). If the password safe they're stored in is
compromised, you need to change the answers to those security questions in
order to secure the account.
This leads to the unusual situation where you can need to call up your bank
and say: "Hi, I'd like to change my mother's maiden name." (Or, I suppose,
father's middle name, first pet's name, place of birth, or whatever.) Banks in
particular are prone to disallowing you from changing your security answers
over the Internet, but all kinds of other businesses can also make this
process hard... presumably because a well-meaning software engineer couldn't
conceive of any reason that a user might want to.
I sometimes use a pronouncable password generator to produce fake names for
security question answers. And I'll tell you what: I get some bemused
reactions when I say things like "I'd like to change my mother's maiden name
from Tuyiborhooniplashon to Mewgofartablejuki."
But at least it forestalls them asking me "So why did you change your surname
to 'Q'?"
LINKS
HTML Security incident last month
HTML KeePassXC
DIR Why did you change your surname to 'Q'