#security questions

Okay, look, they talk to a Google rep in some of the video clips, but I give it a pass because this FREE course is a good baseline for personal internet safety that so many people just do not seem to have anymore. It's done in short video clip and article format (the videos average about a minute and a half). This is some super basic stuff like "What is PII and why you shouldn't put it on your twitter" and "what is a phishing scam?" Or "what is the difference between HTTP and HTTPS and why do you care?"

It's worrying to me how many people I meet or see online who just do not know even these absolute basic things, who are at constant risk of being scammed or hacked and losing everything. People who barely know how to turn their own computers on because corporations have made everything a proprietary app or exclusive hardware option that you must pay constant fees just to use. Especially young, somewhat isolated people who have never known a different world and don't realize they are being conditioned to be metaphorical prey animals in the digital landscape.

Anyway, this isn't the best internet safety course but it's free and easy to access. Gotta start somewhere.

Here's another short, easy, free online course about personal cyber security (GCFGlobal.org Introduction to Internet Safety)

Bonus videos:

(Jul 13, 2023, runtime 15:29)

"He didn't have anything to hide, he didn't do anything wrong, anything illegal, and yet he was still punished."

(Apr 20, 2023; runtime 9:24 minutes)

"At least 60% use their name or date of birth as a password, and that's something you should never do."

(March 4, 2020, runtime 11:18 minutes)

Like, sure, someone could probably figure out where I went to elementary school if they looked into it. But my mom's name is much more public and takes much less digging.

The risk of them misusing that information is very low, but the risk of a dedicated social engineer using the true answers to access your account is not insignificant.

So lie. But don’t forget the lesson from the boy who cried wolf:

Well secured sites never actually store your password, just the result of feeding your password into a mathematical expression. This keeps anyone who gets access to that data from being able to use that password to impersonate you elsewhere.

Your security question replies have no such security. They’re one data breach away from being a salable commodity.

So a single lie is not sufficient. You need to use different lies for every service that asks you security questions.

Just like you should use different passwords for every account.

The solution to keeping track of all those lies is the same: use a password tracker. Security question answers are really just another password, so treat them as such:

don’t use the same one twice

use long randomly generated phrases

keep track of them in a secure password store

I like Selznick’s PasswordWallet because it’s encrypted, 100% offline, and I can sync it between my phone and laptop.

Not a problem. Happy to answer this. The "trackers" aren't programs or any malicious code, {at least, not that I've heard of yet} but rather they're little bits of hidden information within certain CC files that are sent to the downloaders that allow the creator to "track" the file back to who downloaded it. I'll give you an example: Sally is a CC creator, and doesn't want anyone stealing her exclusive content. So within the files of her CC, Sally hides little strings of information. She changes the information slightly with each CC file she sends out {she sends them out via download link so she controls what goes out}. Lo and behold, one of those files somehow makes it onto the pirate-ridden web for FREE! Sally downloads that file, matches up the information it it to her list of strings, and immediately realizes who "leaked" her content and is able to ban them from her patreon account. Now, in theory this seems like a nice method of dealing with things. But the PROBLEM is what is often done AFTER the creator finds out who is leaking their content. For example, typically what happens is "Sally" doesn't just ban the leaker. Sally then grabs their email address and username used on patreon, and then shares THAT information with her creator friends who also have exclusive patreons causing them to "mass ban" the leaker. If for some reason, Sally has pointed the finger at the wrong person due to her own errors, that person could be banned from multiple people's patreons for doing nothing wrong, and possibly lose their patreon account. In addition, Sally was never given consent to share that person's email and name with other parties. {AND THIS PRACTICE IS AGAINST THE PATREON TERMS OF SERVICE!!!!} The name could be a username or fake name, but many people have their real names attached to their patreon account, leading to possible doxxing threats. And some people even if they don't have real names attached to a patreon account, might have them in their email too.

What is the name of the first member in your family to die?

On what street did you witness your first murder?

What is the name of your least favorite child adopted by Batman?

What is the type of weapon you last argued with Red Hood about?

In what year did you abandon your hope of going to college?

What type of martial arts do you romanticize to avoid a healthy dialogue of why you are a vigilante?

When did you stop questioning the fact that you put on a costume at night to beat people up?

What is the name of your favorite animal?

---