alt Hacker News> At least those you can turn into covert password fields because they cannot verify them.
Don't do this.
I tried to do this and it turned into a very bad time with their CSRs.
The "security questions" are designed to be answered verbally. They are also designed to be "something you know" that is unlikely to be forgotten, misplaced, or change. Rather than randomized passwords, they're supposed to be something intrinsic to your life that you always remember, especially in a crisis time, and when your scribbled-down credential list is missing.
Based on imitation of a very paranoid security wonk acquaintance, I once set all these security answers to long strings of hexadecimal digits, auto-randomized by KeePass. Big mistake.
They worked for as long as I was setting them, but eventually a CSR, verbally on the phone, began to ask me what they were. The hex strings were nearly impossible to dictate over the voice connection. Also the CSR was kind of pissed about this misuse.
Security questions/answers aren't passwords. Don't subvert them into this use. Your service provider knows what they're doing. Doing this "clever" shit will only hurt yourself, and you're shooting future-you in the foot.
Replies
They don't know what they are doing if they have those questions. I've found mine in multiple data breaches. If they were real they'd broadly grant access to every account.
Or maybe to be more accurate: they do know what they're doing, recovery is a cost center so they're minimizing it. But outside of special cases with special statutory affordance (like credit card fraud) the loss is on you* if you get robbed via their weak security. So companies are intentionally minimizing their costs because you're the one that takes the cost when their security is poor.
I have encounter the pronounceable issue-- though reading 32 hex characters over the phone really wasn't *that* bad. So now-- and for the last 15 years-- I make them pronounceable passwords.
> especially in a crisis time
I've tried to organize my life so that I never need 'crisis' access to some stupid online account. I recommend it!
Putting aside whether it's best to use them as the company intended, random pronounceable word sequences should be strictly-better than hex/ASCII ones. (Presuming the company isn't limiting "answers" to unreasonably short character lengths.)
Another risk is that someone will call up and say "it's just a bunch of random stuff" and the customer service rep will go: "Okay, that's right, moving on..."