How Systematic Lying Can Improve Your Security

After any major breach, the entire security community clamors to weigh in. The headlines are filled with advice and suggestions as vendors advocate for their solutions and consultants push training. The response of breached companies is almost always the same: they offer free credit monitoring. I have plenty of thoughts on why that is ineffective, but the short version is that this approach is like putting up a sign saying that a bridge is out… behind you.

Predictably, the usual advice is offered about strengthening passwords, utilizing two-factor authentication, and the like. But what you really need to do to protect yourself from the effects of a breach depends on what information was revealed. Whether password lists, account names, credit card information, personal identifiers, financial information, or personal information, each of these can lead to different kinds of attacks that require different defenses. In light of this, I suggest a change that anyone can make, which is particularly relevant to the Equifax breach but is also generally effective. So, in addition to the methods listed above, I suggest taking advantage of one of the most effective and durable tactics: lying.

There are three kinds of attacks enabled by the Equifax breach. First, the financial and personal information can be used to open fraudulent lines of credit. The best defense for this is a credit freeze at all three credit reporting bureaus. Second, the financial information can help attackers target high-value individuals for other kinds of scams or attacks. For targeting, a combination of anonymity and paranoia are your best bet. Finally, the information exposed reveals details about the victims that are often used in security questions. This brings me to my point about lying — to avoid losing personal information via security questions, lie about the answers.

The fundamental problem with the security questions on websites is that they are asking for discoverable biographical questions. They might ask the name of the street where you grew up. Using the Equifax data, attackers can probably connect you to your parents. They will know the addresses where both you and they lived, and what your age was at the time, so they know all the likely answers. We also reveal many other answers directly through our social media posts, pet names, relatives, etc.

If you lie in your answers to these questions, your answer becomes much harder to guess. Saying I grew up on 3rd Street instead of 5th is a good start, but it is still a common street name. Saying my favorite color is "Saint Bernard" is much better. These answers are just free-form text fields — you can put in anything at all, including a pure random string.

Of course, the answers to these questions can be exposed as well. As with passwords, it is important not to reuse the same answers over multiple websites. On one website, my mother's maiden name could be "Blue Dyspeptic Wallaby," while on another it might be "Invisible Orange Planets Laugh Silently."

Now, if you think it is unreasonable to be asked to keep track of unique passwords for each account, you may be reaching for torches and pitchforks about now. The solution here is to use a password vault. There are many available with strong security and the ability to sync between all of your devices. My two favorites are 1Password and Dashlane. And no, I don't own stock in, or work at, either of them.

The trick is to take advantage of the notes field available in these applications. When you save a username/password, you can also put the security questions and answers in the notes field to make sure you keep track of all the different lies you have told. If you are asked for new answers to additional questions, simply add those to the note. With the vault syncing, you will have all the answers at your fingertips whenever you need them.

Like adopting strong unique passwords, this can seem like a monumental undertaking. After all, how many different accounts do you have? A quick glance at my vault suggests that I have about 1,000 of them. Don't worry — you don't need to change them all at once. A good practice is to start with just your most critical accounts: financial institutions and your password recovery email account.

Once you have those accounts protected, just make a point of using unique strong fake answers for each new account you create, and updating existing ones when you're prompted to change your password. From time to time, take a few minutes more to change some of your other important or frequently used accounts. After a short while, your security will be substantially improved. All through the ancient technique of lying.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.