You Should Be Faking Your Security Answers

You Should Be Faking Your Security Answers

Estimated reading time: 5-6 minutes

• Relying on truthful security answers is a major vulnerability due to widespread public data and frequent data breaches.
• Faking your security answers, when combined with a robust password manager, dramatically improves your online security posture.
• Password managers are essential for securely storing these fabricated, unique responses, making them accessible to you but impenetrable to hackers.
• Generate unpredictable, random answers using passphrase generators or unrelated word combinations, and consistently apply this strategy across all your online accounts.
• This counter-intuitive method creates an almost impenetrable defense, effectively foiling common social engineering tactics and data-breach exploits.

• The Hidden Risks of Real Security Answers
• Fortify Your Accounts with Fabricated Responses
• 3 Actionable Steps to Boost Your Security
  • Step 1: Generate Truly Unpredictable Answers
  • Step 2: Store Your Fabricated Answers Securely in a Password Manager
  • Step 3: Implement Consistently Across All Accounts
• Real-World Example: Foiling a Phishing Attempt
• Conclusion: Reclaim Your Digital Privacy
• Frequently Asked Questions

The Hidden Risks of Real Security Answers

We’ve all encountered them: those seemingly innocuous security questions. “What was your mother’s maiden name?” “What was the name of your first childhood pet?” Designed to be a fortress for your online accounts, these personal inquiries are often the first line of defense against unauthorized access. Yet, in our hyper-connected world, relying on truthful answers to these questions is no longer just risky – it’s a critical vulnerability. It’s time to rethink this traditional approach and embrace a more secure, albeit counter-intuitive, strategy: faking your security answers.

The original intent behind security questions was sound: use unique, personal information that only you would know. However, the digital age has eroded this premise. Our lives are increasingly public, with social media, online databases, and countless data breaches inadvertently exposing details once considered private. A determined hacker can piece together information about your past, your family, or your pets with surprising ease, turning your personal security questions into open doors rather than locks.

Consider the stark reality of modern data privacy, as highlighted by The Markup:

“The Gentle January series shares one practical privacy tip a day from a Markup staffer who actually uses the advice in their own life.

What’s your mother’s maiden name? What was the name of your first childhood pet? Occasionally you’ll have to answer questions like this to create a login with certain companies—in my experience it’s usually financial institutions and health care conglomerates.

The idea is that someone trying to break into your account by resetting your password wouldn’t know the answers to these personal questions.

That may be true—or not, if that hypothetical hacker can learn the answers from other sources. But one way to guarantee they won’t know the answers to these questions is if you make them up and save them in your password manager for future reference. As a bonus, you won’t be sharing details about your life that could end up getting exposed along with those of 35.8 million other people.

I recommend searching Duck Duck Go for “passphrase” or visiting useapassphrase.com to get easy-to-say but hard-to-guess candidates.

Then, confident in the knowledge that you’ve closed one potential avenue for leaking personal information, relax, call your mom (or Ms. Important Gem Pasta as your bank would call her), and ask her to give good ol’ Paradox Dropkick Neurotic a scratch behind the ears for you.

Have your own practical privacy tip?

Email it to tips@themarkup.org, along with how you’d like to be identified. We will highlight some reader tips near the end of Gentle January.

Credits
Tomas Apodaca, Journalism Engineer
Design and Graphics
Gabriel Hongsdusit
Engagement
Maria Puertas
Editing
Ryan Tate
Michael Reilly

Also published here

Photo by Laurin Steffens on Unsplash

This insight underscores a crucial point: if a hacker cannot find the answer because it doesn’t exist, your security dramatically improves. Fabricating these answers is a powerful way to make your accounts impenetrable to common social engineering and data-breach exploits.

Fortify Your Accounts with Fabricated Responses

The strategy is simple: create answers that are entirely unrelated to your actual life. Instead of your real high school mascot, conjure “CrimsonWhisperEcho.” These made-up responses are impossible for hackers to guess or research because they exist solely within your secure knowledge base. The key to making this strategy effective is consistency and reliable storage, which is where a robust password manager becomes essential. This tool will securely store your unique, nonsensical answers, allowing you to access them effortlessly while keeping them hidden from everyone else.

3 Actionable Steps to Boost Your Security

Step 1: Generate Truly Unpredictable Answers

The goal is to create answers that are random and impossible to associate with you. Think of them as mini-passphrases. Combine unrelated words, or use a phrase generator to ensure unpredictability. Avoid anything that could even remotely be linked to your public or private life.

• Use Passphrase Generators: Leverage tools like useapassphrase.com or search DuckDuckGo for “passphrase generator” to create easy-to-type, hard-to-guess answers.
• Combine Random Words: String together three or four distinct, nonsensical words, e.g., “AzureWhirlwindBalloon” for a pet’s name.
• Avoid Personal Connections: Even if it feels clever, don’t base answers on inside jokes or obscure personal facts. Truly random is truly secure.

Step 2: Store Your Fabricated Answers Securely in a Password Manager

Your password manager isn’t just for passwords; it’s the perfect vault for your fake security answers. Most leading password managers allow you to add custom fields or secure notes to each login entry, ensuring your unique answers are always on hand when you need them.

• Create Custom Fields: For each online service, add custom fields within your password manager entry to record the exact security question and your chosen fake answer.
• Use Secure Notes: Alternatively, create a secure note attached to the login entry, clearly detailing each question and its fabricated response.
• Be Precise: Always copy and paste the question exactly as presented by the service, and record your fake answer meticulously.

Step 3: Implement Consistently Across All Accounts

This strategy gains its strength through widespread application. Start with your most critical accounts and gradually expand. Make it a habit to use fake answers for every new account you create and when prompted to update existing security details.

• Prioritize High-Value Accounts: Begin with banking, email, healthcare, and primary social media profiles.
• Integrate with Routine Security Checks: Whenever you update a password or review account settings, take the opportunity to replace real security answers with fake ones.
• Make it a Default: Treat security questions like passwords – always generate a unique, fake answer and store it.

Real-World Example: Foiling a Phishing Attempt

Imagine a hacker obtains your email through a data dump and tries to reset your credit card password. They visit the bank’s site, enter your email, and are prompted, “What was the name of your first car?” Unbeknownst to them, you faked the answer, storing “CrimsonWhisperEcho” in your password manager, even though your real first car was a “Honda Civic.” The hacker, finding no public record of “CrimsonWhisperEcho” or the correct model, is immediately thwarted. Your account remains secure, while you confidently retrieve your unique, fake answer from your password manager.

Conclusion: Reclaim Your Digital Privacy

Faking your security answers might feel unconventional, but it’s a highly effective and practical method to bolster your online security. By disconnecting these authentication methods from your real-life data and entrusting uniquely generated responses to your password manager, you establish an almost impenetrable defense against common hacking tactics. This simple yet powerful shift empowers you to reclaim control over your digital identity, ensuring your personal information remains truly private and secure.

Frequently Asked Questions

Why shouldn’t I use real answers for security questions?

Using real answers for security questions is risky because personal information (like your mother’s maiden name or first pet’s name) is often publicly available through social media, online databases, or past data breaches. Hackers can easily find these details, turning your security questions into an easy entry point to your accounts.

What is a password manager and why do I need one for this strategy?

A password manager is a secure application that stores all your login credentials, including usernames, passwords, and now, your fake security answers. You only need to remember one master password to access your vault. It’s essential for this strategy because it allows you to generate and store complex, unique, and fabricated answers without having to remember them yourself, keeping them safe from prying eyes.

How do I create a “fake” security answer?

To create a fake security answer, think of something entirely random and unrelated to your personal life. You can combine nonsensical words (e.g., “AzureWhirlwindBalloon”), use a passphrase generator like useapassphrase.com, or simply invent a phrase that sounds real but isn’t. The key is unpredictability and non-correlation to your actual identity.

Is it really more secure to use fake answers?

Yes, it is significantly more secure. If an answer to a security question doesn’t exist in your real life, a hacker cannot find it through research or social engineering. By storing these unique, fabricated answers in a secure password manager, you create a stronger barrier against unauthorized access compared to relying on easily discoverable personal facts.

What if I forget my password manager master password?

Forgetting your master password for a password manager can be problematic, as most are designed with strong encryption that prevents recovery if the master password is lost. It’s crucial to choose a strong, unique master password that you can remember, perhaps using a memorable passphrase or a technique like the “Diceware” method. Some password managers offer emergency kits or trusted contact features, but typically, the master password is your sole key.