Security question fail.

Spot the problem:

You work for company X.

  • Phone rings: “Hi, my name is Alice, I work for company X”
  • “Hi Alice, this is Bob, in order to verify that you do actually work for X, what is your employee number and phone extension, I’ll call you back when verified”.
  • “Okay Bob, it’s Alice, employee number 1234 and I’m on 555-5555”
  • You look up the employee database and sure enough, Alice is there with number 1234.

Were you talking to Alice?

Will you be talking to Alice if you dial 555-5555?

8 thoughts on “Security question fail.

  1. You have to be kidding me…

    And I have to take this “class” soon myself.

  2. I take it you have no way to verify that 555-5555 also belongs to Alice?

  3. Xaprb: yep.

    Scott: any personell directory is going to have a correct phone number anyway. so getting Alice’s phone number from Alice adds absolutely nothing. If you call Alice back and she’s like “dude, I didn’t call you” then you still know somebody was trying some social engineering on you. Otherwise, you just have a phone number that was valid for some short amount of time (or, more likely, fake).

    Monty: and you can’t continue the course until you put in the wrong answer… gah. should have left it not done. There is (of course) no obvious “report bug” link either.

  4. Monty: then you and your manager get emails saying you haven’t completed the required training…. on second thoughts, I should have done that until they fixed it. I like causing trouble :)

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.