Tags

,

Opening my social feeds this morning for a quick browse over a cup of coffee and some toast, it doesn’t take long of scrolling down to find a post asking “What was the first car you owned? No Lying <laughing emoji>”. This post has 61k likes, 959k Comments and 8.4k shares and was only posted on 9th August. And people wonder why they get hacked.

Password systems for a long time have used a similar set of questions as they are usually easy to answer and remember, because they were life events. Questions such as:

  • What is your mother’s maiden name?
  • What is the name of your first pet?
  • What was your first car?
  • What elementary school did you attend?
  • What is the name of the town where you were born?

These types of social engineering data gathering posts are nothing new, but it would seem that people do not understand the greater risks around answering them.

With the large amount of data appearing on the dark web for usernames and a persons details (even if they don’t contain passwords) matching this data with the answers from social posts such as the one above gives a potential hacker more information about you. They now have the ability to reset your password using the answers you have provided to the security questions and take control of your accounts.

How many of you reading this post have answered the question similar to “What elementary school did you attend” or anything to do with education, but forgot that the same information is already lurking in your LinkedIn profile?

One way to check if your in any data on the dark web is to check using your email address at a service such as https://haveibeenpwned.com/

If you see a family member or friend post these types of questions on social media, it may be worth a conversation with them to advise of the dangers of such posts and the consequences of social engineering.

Tips to stay safe

Here are some tips for staying safe with your identity.

  • Don’t answer these types of posts on social media, even if its a friend who has posted it.
  • Check your not using an answer to a security question that is already in your social profile.
  • Use fictitious information instead of real information, but something you can remember.
  • Treat these answers like passwords and think about adding complexity to them.
  • Use two factor authentication where it is available on a system.

Further Reading