Something you know…and that someone else knows. It can happen.
Many systems require more than one knowledge-based modality, which is why they sometimes ask for other things like your mother’s maiden name.
This of course is not foolproof. Your sister that hates your guts, for example, obviously knows your mother’s maiden name. And even complete strangers, especially those with nefarious intent, can deduce your personal information.
Let me introduce you to Doug.
How Doug learned Donna’s mother’s maiden name…and more
Assume that Doug wants to hack Donna’s account but needs some personal information to do so. This is somewhat tough, since Donna’s Facebook account is private and can only be seen by her friends. Well, Doug knows that Belle is a friend of Donna’s, and Belle’s Facebook password is “password1.” Problem solved.
Doug uses Belle’s account to read Donna’s posts and finds some remarkably interesting ones. Not that she’s posting her Social Security Number or anything, but what did she post?
- “Happy birthday to my mom!” (This particular post was loved by Jane Davis, who wrote “Thank you dear daughter.”)
- “Happy 30th birthday to me!”
- “Hey, look at this picture of my new driver’s license. My picture actually looks halfway decent.”
- “Hey, look at this picture of my senior citizen bus pass. Yeah, I’m old.”
- “I cried when I looked at this old picture of my dog Scamper, taken in front of my childhood home on Mulberry Street.”
If you’re keeping score at home, Doug now knows the following information about Donna:
- Her mother’s maiden name.
- Her date of birth (from her birthday post and her driver’s license picture; her senior citizen’s bus pass doesn’t have her birthdate but does have her birthday).
- Her driver’s license number.
- The name of her favorite pet.
- The name of the street she lived on as a child.
More than enough for Doug to impersonate Donna.
Bredemarket 