Fun with secret questions and answers

May 12, 2010 12:55 AM

"My new bank, Ally Bank, configures a security question and answer for customer service calls. In addition to your SSN, date of birth, and mother's maiden name they also ask you the question you specify and wait for the answer you've provided. A real live human operator always asks the question and waits for a real live answer. This measure has the potential to not just improve my account security but add entertainment value as well."
posted by Ljubljana (134 comments total)

{Previous Zardoz goodness}
posted by Ljubljana at 12:56 AM on May 12, 2010

Who put the fun in spaghetti?
posted by uncanny hengeman at 12:56 AM on May 12, 2010

I'm in actual disbelief that one of my bank's security question is still, "Mother's Maiden Name", which can be easily found on the intar-nics.
posted by alex_skazat at 12:58 AM on May 12, 2010 [1 favorite]

Q: What the hell is your fucking problem, sir?
A: This is completely inappropriate and I'd like to speak to your supervisor.

OK, pretty much what I was expecting when I clicked the link, but that one made me laff. I bet some hardass in the bank brings in an "inappropriate question" rule.
posted by uncanny hengeman at 1:00 AM on May 12, 2010 [1 favorite]

Some other questions from the comments there and here:

Q: I see that you have no secret question on your account.
A: Good.

Q: Do you speak English?
A: Que?

Q: What does Marsellus Wallace look like?
A: What?

Q: What is love?
A: Baby don't hurt me, no more.

Q: Every morning for weeks, I've been getting into the office before my coworker and farting on her phone and keyboard as much as I possibly can.
A: Ew.

Q: Error 352: Cannot locate cust_ID in database
A: Error 312: strAnswer if Undefinded

posted by Ljubljana at 1:12 AM on May 12, 2010 [19 favorites]

"Oh, I set up a secret question alright. I set up some zen shit."
posted by Rhaomi at 1:15 AM on May 12, 2010 [11 favorites]

I'd say the best option is cheesy pickup lines :
Q: If I said you had a beautiful body, would you hold it against me?
A: Sorry, you're not my type.
(Suggested by yt at Schneier's)
posted by jeffburdges at 1:34 AM on May 12, 2010

An invisible man is sleeping in your bed, who you are going to call?
posted by Damienmce at 1:47 AM on May 12, 2010 [7 favorites]

I think it was suggested over at Bruce Schneier's blog that the best way to make those questions more secure is to have an unrelated answer, i.e.

Q: What is you mother's maiden name?
A: Three ocelots in a basket.

A bit harder to guess...
posted by Harald74 at 1:51 AM on May 12, 2010 [5 favorites]

Q: Do you know why I think you're so sexy?
A: Christ, what an asshole.

Q: I've been embezzling hundreds of thousands of dollars from my employer, and I don't care who knows it.
A: Christ, what an asshole.

Q: For the remainder of this conversation, "How can I help you today?" actually means "Would you like to buy some mescaline?" Do you understand?
A: Christ, what an asshole.

I rest my case.
posted by le morte de bea arthur at 2:16 AM on May 12, 2010 [11 favorites]

I'm not sure if you think those questions are asshole-y, or if your answer to the secret question is "Christ, what an asshole".
posted by spaceman_spiff at 2:21 AM on May 12, 2010

Oh, now I have to explain it and it's not funny any more.
posted by le morte de bea arthur at 2:24 AM on May 12, 2010 [4 favorites]

I bet they have at least 50 geeks people submit

Q: What's the air-speed velocity of an unladen sparrow?
A: What do you mean? An African or European swallow?

Or possibly

Q: What's your name?
A: Fuck you, that's my name. You want to know why, mister? Because you drove a Hyundai...

(Be sure to include all the rest of the dialogue from the scene for maximum security.)

I think it might be neat to involve the bank employee in a bit of poetry.

Q: Oh, when I was in love with you / Then I was clean and brave, / And miles around the wonder grew / How well did I behave.

A: And now the fancy passes by / And nothing will remain, / And miles around they'll say that I / Am quite myself again.

posted by maxwelton at 2:28 AM on May 12, 2010 [9 favorites]

I feel so old. Back in my day we didn't have to make up a question that someone else could ask us just so we could answer the made up question with an answer.

But, I'm old. Right?

Yes, that was my question.
posted by twoleftfeet at 2:40 AM on May 12, 2010

I bet some hardass in the bank brings in an "inappropriate question" rule.

So years ago one of my clients was a bank who was introducing the ability to give accounts nicknames via Internet Banking, but those names would show up everywhere (tellers' terminals and so on), and it was felt that we might want a swear checker so people couldn't scandalise other holders of joint accounts, or bank staff, by calling their accounts things like "cuntmittens".

So, yes, you're probably right.

(As an aside, the guy implementing this was a first-gen Kiwi who'd come from China originally; when he scanned the list of a couple of hundred words and word fragments, he said, "You know, we don't have this many rude words in Chinese. This is amazing.")
posted by rodgerd at 3:13 AM on May 12, 2010 [15 favorites]

I once had to Western Union some money to a designer who really needed it "that day". Somewhere in the money sending process, the form prompts and asks if you wish to send a personalized greeting, which "the teller will read aloud to your recipient". Not realizing this cost an extra $2.00, I quickly mashed out "Drew, you motherfucker." Short, sweet.

About two hours later, Drew pops online:

"So I left my ID at home and couldn't get the money at the Circle K. But I did get called a motherfucker."

"Oh yeah?"

"Yeah, this 17-year-old chick looked down at the slip and said 'there's a message here. I'm supposed to say 'Drew, you're a motherfucker.'"

"Awesome."

(Since he couldn't receive the money, I got all of it back, including the $2.00.)
posted by disillusioned at 3:33 AM on May 12, 2010 [71 favorites]

This measure has the potential to not just improve my account security

No, no it does not, for the same reason all the cute images and pre-canned security questions also do not - A "Man in the Middle" attacker (which doesn't require an actual human, just a cleverly redirecting webpage) can simply relay the request from the bank to you, and the answer from you back to the bank.

I use online banking. Very convenient. But don't ever consider it even remotely secure.
posted by pla at 3:47 AM on May 12, 2010

A "Man in the Middle" attacker (which doesn't require an actual human, just a cleverly redirecting webpage) can simply relay the request from the bank to you, and the answer from you back to the bank.


Yes, but this security measure is for customer service TELEPHONE CALLS, not online communications. Unless you are envisioning a situation with a crazed identity thief gunman in the call centre?
posted by elizardbits at 3:49 AM on May 12, 2010 [4 favorites]

This is comedic genius and it just made my day. :D

My secret question would be "What are taters?" with the correct answer being 5 seconds of total silence.
posted by aheckler at 3:51 AM on May 12, 2010 [10 favorites]

$1.50, same as in town.
posted by Kirth Gerson at 3:58 AM on May 12, 2010 [2 favorites]

My job also has a similar "ask and answer a security question that you get to pick" thing set up with the tech support guys.

All of whom always burst out laughing when they saw that my own were this:

Q. What's the airspeed velocity of an unladen swallow?
A. African or European?
posted by EmpressCallipygos at 4:11 AM on May 12, 2010 [1 favorite]

Q: Who are you?
A: I am the Architect. I created the matrix. I've been waiting for you. You have many questions, and although the process has altered your consciousness, you remain irrevocably human. Ergo, some of my answers you will understand, and some of them you will not. Concordantly, while your first question may be the most pertinent, you may or may not realize it is also irrelevant. Your life is the sum of a remainder of an unbalanced equation inherent to the programming of the matrix. You are the eventuality of an anomaly, which despite my sincerest efforts I have been unable to eliminate from what is otherwise a harmony of mathematical precision. While it remains a burden to sedulously avoid it, it is not unexpected, and thus not beyond a measure of control. Which has led you, inexorably, here.

And if you get a single word wrong - they close your account.
posted by Sebmojo at 4:11 AM on May 12, 2010 [3 favorites]

I remember how much fun I had typing paradoxical "facts" into Cyc a few years ago and this has just as much potential to confuse and entertain.

Also, I would change my security question every 3 days as I think up ever-more wacky questions. This system really promotes excellent security through hilarity.
posted by DU at 4:20 AM on May 12, 2010

Q: Are you the gatekeeper?
A: I am the Keymaster.
posted by subbes at 4:38 AM on May 12, 2010 [4 favorites]

I don't understand why you even need the question part. I mean, your answer doesn't have to have anything to do with the question, right? So why bother? Or why not make it more interesting and require a simultaneous duet. Like, you say "parsley, sage, rosemary and thyme" and the customer service rep has to say, "GENERALS ORDER THEIR SOLDIERS TO KIIILLLL" in that fake falsetto.
posted by Civil_Disobedient at 4:53 AM on May 12, 2010 [2 favorites]

I would think it would be most helpful to have something that you KNOW you won't forget, maybe even something you say automatically so there's no chance you'll get locked out. For example, I can't hear anyone say "Hi, everybody!" without saying (ideally in a whisper, in most cases) "Hi, Doctor Nick!", so honestly even if I got amnesia or something I could probably still get into my bank account. Unfortunately, if that were my question, so could everyone else.
posted by Mrs. Pterodactyl at 5:09 AM on May 12, 2010 [5 favorites]

Q: If a barber shaves all and only those men in town who do not shave themselves, does he shave himself?
A: Can I change my question?
posted by qvantamon at 5:11 AM on May 12, 2010 [5 favorites]

Mine would probably be something like this:

Q: Is this a rhetorical question?
A:
posted by jeremias at 5:14 AM on May 12, 2010 [1 favorite]

many of these security questions aren't very secure. Less secure than your mother's maiden name.
posted by garlic at 5:14 AM on May 12, 2010 [1 favorite]

I've had an account with Ally for several years and crack up when I call and get asked, "Who is your daddy and what does he do?".
posted by the biscuit man at 5:33 AM on May 12, 2010 [3 favorites]

I don't understand why you even need the question part.

So that you know you aren't getting phished.
posted by shakespeherian at 5:39 AM on May 12, 2010 [4 favorites]

many of these security questions aren't very secure. Less secure than your mother's maiden name.

The questions are as good or as bad as you make them, which could be a lot better or a lot worse than typical ones. I see that as an improvement, since "mother's maiden name" doesn't give you any room for improvement.

But an important part of implementing a system like this is giving users guidance towards good questions. "Are you the Gatekeeper?" isn't a good question because pretty much anyone who lived through the mid 80s will recognize it. So people need to be cautioned to stay away from pop-culture references, and instead create a question that only they would know the answer to.

Another big component is how many guesses you get while trying to answer. If you get the question wrong and the CSR immediately hangs up and puts the account on hot status, that would be pretty high security but there's no way they're actually going to do that. I bet in practice you get something like 3 or 5 tries, if you sound like you're genuinely trying to remember, before the CSR will cut you off. That really changes the kind of questions you need to invent. It's relatively easy to form a question that only you can answer correctly the first time -- you pick one that has an obvious answer and then don't use the obvious answer. But choosing a question that you can answer correctly but an attacker won't guess given five tries is a much more difficult problem.
posted by Kadin2048 at 5:54 AM on May 12, 2010 [4 favorites]

I never really understood why more people don't give ridiculous answers regardless of the question. There are so many things I could easily associate with my late grandmother, such as the name of the street on the LES where she grew up, or the name of her favourite menu item at IHOP, or her favourite Golden Girl. When the "mother's maiden name" question comes up, it would hardly occur to me to use the actual name when I could instead use "rooty tooty fresh and fruity".
posted by elizardbits at 6:06 AM on May 12, 2010 [4 favorites]

Note: no, that is not the answer to my security questions. I am not new to the internets kthxbie.
posted by elizardbits at 6:07 AM on May 12, 2010 [1 favorite]

My favorite from the LJ thread so far is:

Q: Tell me honestly, Sir: Are you ready to do some God Damn Banking?
A: Fuck yes I am. Let's fucking do this.
posted by grubi at 6:16 AM on May 12, 2010 [80 favorites]

Q. Pete and Repeat went into the store. Pete came out. Who was left?
posted by Philosopher Dirtbike at 6:16 AM on May 12, 2010 [2 favorites]

Q: Are you trying to hack into this account?
A: Yes.
posted by rongorongo at 6:17 AM on May 12, 2010 [1 favorite]

I think a fun variation might be reversing the Q&A, all "Jeopardy!"-style:

Q: The category is "City Mottoes." The answer is! "Trenton, NJ."
A: What is "Trenton Makes; The World Takes"?
posted by grubi at 6:19 AM on May 12, 2010 [1 favorite]

For what little it's worth, we tried setting our banking security questions' answers to random 8-character strings (generated and stored in PasswordSafe). We rapidly learned that, at least when the question is "Does this process undermine the security of the system?", no matter how slowly and clearly you say something like "capital K; lower m; period; numeral 8; capital F; capital N; underscore; underscore; lower q" to the person on the 'phone, they'll get it wrong repeatedly and eventually just ask you for your old 'phone number and details of your three most recent transactions.
posted by overyield at 6:22 AM on May 12, 2010

Semi-related, I heard a story about a customer who called support because he had forgotten his password. The rep looked up the account and discovered that the password was horrifyingly racist. She then took great pleasure in informing the caller that the company code of conduct prevented her from speaking his password aloud.
posted by Faint of Butt at 6:30 AM on May 12, 2010 [1 favorite]

Q: It's true what they say, Frank...dead men tell no tales.
A: YEEEEAAAAAAHHHHHH!

Q: Ooh, baby, do you know what that's worth?
A: Ooh, heaven is a place on earth.

Q: Next, sir, I'll need you to tell me your...your...oh, sorry, I can't do this any more, she left me, I can't take it, my world is pitiable darkness, the light f my life has gone out, I CAN'T TAKE THIS REJECTION!
A: Tell me about your mother.

Q: To access your account, please count backwards from 4,764 in steps increasing by one every three numbers.
A: [silence for precisely three seconds, followed by deep sigh]
posted by ZsigE at 6:30 AM on May 12, 2010 [2 favorites]

Q: Do you know the password?
A: No
posted by ijoshua at 6:42 AM on May 12, 2010

Q: ?
A: !
posted by Sutekh at 6:46 AM on May 12, 2010 [1 favorite]

What?
What
posted by weapons-grade pandemonium at 6:54 AM on May 12, 2010

My problem when I make up answers for security questions (which I always do) is that I often forget what I made up. And since I don't have to answer them very often, except say, when using a new computer, it can be quite annoying.

"Shit, which persona did I answer this question as? Captain Mal? One of the Scoobies? Sam Vimes?"
posted by kmz at 7:04 AM on May 12, 2010 [3 favorites]

Q: What gives you that special... satisfaction?
A: I go to funerals.
posted by ericost at 7:08 AM on May 12, 2010 [2 favorites]

Q: One-one-eight-seven at Hunter-Vasser.
A: That's the hotel.
posted by The Bellman at 7:19 AM on May 12, 2010 [2 favorites]

Q: Describe in single words only the good things that come into your mind about... your mother.
A: My mother?
posted by The Man from Lardfork at 7:22 AM on May 12, 2010 [4 favorites]

Q: HONEY HAVE YOU SEEN THE CAT? AND WHY ARE ALL THE COOKIES MISSING??
A: >:3
posted by Damn That Television at 7:22 AM on May 12, 2010 [2 favorites]

Q: An invisible man is sleeping in your bed, who are you going to call?

A: Is it. . . . Ghostbusters 2?
posted by The Bellman at 7:25 AM on May 12, 2010 [9 favorites]

I hope the grunt earning £5.85 per hour to listen to complaints finds it as amusing.
posted by mippy at 7:25 AM on May 12, 2010

Q: What is your mother's maiden name?
A: I was not born of woman, foolish mortal. For your insolence I shall tear your limbs from your trunk and leave you to wither in the arid Wastes of [mother's maiden name].
posted by infinitewindow at 7:27 AM on May 12, 2010 [5 favorites]

Q: We are going to write an essay--of no less than a thousand words--describing to me who you think you are.
A: But we think you're crazy to make an essay telling you who we think we are. You see us as you want to see us... In the simplest terms, in the most convenient definitions. But what we found out is that each one of us is a brain... ...and an athlete... ...and a basket case... ...a princess... ...and a criminal... Does that answer your question?... Sincerely yours, the Breakfast Club.
posted by Hardcore Poser at 7:32 AM on May 12, 2010 [1 favorite]

Q: The tortoise lays on its back, its belly baking in the hot sun, beating its legs trying to turn itself over, but it can't. Not without your help. But you're not helping. Why is that, Leon?
A:
posted by komara at 7:33 AM on May 12, 2010 [1 favorite]

A few years ago, a few customer service agents at Lloyds bank in the UK had some of their own fun with this, and subsequently got into a bit of trouble for it.
posted by schmod at 7:38 AM on May 12, 2010

Q: I'm the Doctor.
A: Who?
posted by schmod at 7:39 AM on May 12, 2010 [3 favorites]

"Yes, but this security measure is for customer service TELEPHONE CALLS, not online communications. Unless you are envisioning a situation with a crazed identity thief gunman in the call centre?"

A man in the middle attack on a phone line doesn't require a gun man, merely access to either the customer's demarcation box or the telco box at the end of the street.

"Semi-related, I heard a story about a customer who called support because he had forgotten his password. The rep looked up the account and discovered that the password was horrifyingly racist. She then took great pleasure in informing the caller that the company code of conduct prevented her from speaking his password aloud."

This is one of the reasons good systems don't allow customer service to see your password.
posted by Mitheral at 7:39 AM on May 12, 2010

Q: Sir, are you classified as human?
A: Negative, I am a meat popsicle.
posted by phredgreen at 7:40 AM on May 12, 2010 [10 favorites]

Q: Computer, can you render a nude Tayne?
A: Nude. Tayne.
posted by bjork24 at 7:45 AM on May 12, 2010 [6 favorites]

Faint of Butt: "The rep looked up the account and discovered that the password was horrifyingly racist."

Major security fail right there. Passwords should never be stored as plaintext.
posted by brokkr at 7:49 AM on May 12, 2010 [1 favorite]

Am I the only one weirded out by the term "Maiden Name"?

"What was your mother called before she partook of the sinful flesh of a man?"
posted by billyfleetwood at 7:50 AM on May 12, 2010 [4 favorites]

Wasn't this a Eugene Mirman stand-up bit? yeah here it is.
posted by jrb223 at 7:57 AM on May 12, 2010 [3 favorites]

Q: What is best in life?
A: To crush your enemies, see them driven before you, and to hear the lamentation of their women.
posted by contessa at 7:58 AM on May 12, 2010 [1 favorite]

Yeah, I have too many of these to ever remember, and the more clever I get the worse I suffer later. Every time a CSR asks me my special security password/phrase/answer, it turns into a game of Twenty Questions, which got easier once I realized they will help you out.

"Before I can assist you, may I have your secret passphrase please."
"Passphase? What? I have a secret passphrase?"
"Yes it's right here on your account."
"Wow... no idea. Can I have a hint?"
"It's someone's name."
"Um..... Captain Crunch?"
"No, sorry."
"Does it start with P?"
"No, sorry."
"Well it's probably Jingleheimer or Dumbledore or Ochocinco then."
"Close enough, thank you. Now how can I help you today?"

posted by rokusan at 8:03 AM on May 12, 2010 [5 favorites]

Q: Are you a god?
A: Yes.
posted by King Bee at 8:10 AM on May 12, 2010 [4 favorites]

Q: What?
A: Say what again motherfucker, say what again, I dare you, no I double dare you, say what again...
posted by warbaby at 8:12 AM on May 12, 2010

Major security fail right there. Passwords should never be stored as plaintext.

Serious question: How do they verify your answer if they can't see the answer? Do they type it in to something which is verified?
posted by a womble is an active kind of sloth at 8:16 AM on May 12, 2010

Q: Do you believe in having sex?
A: Hell Yeah!!!
posted by LouieLoco at 8:17 AM on May 12, 2010

Q: They say this cat Shaft is a bad mother–
A: Shut your mouth.
posted by WCityMike at 8:19 AM on May 12, 2010 [3 favorites]

The movie quotes are fairly insecure, amusing as they may be.

I support the effort to have something entirely nonsensical, though:

Q: How do you kill a ghost?
A: The cat is walking on cinnamon.
posted by LSK at 8:20 AM on May 12, 2010

Q: What what?

A: In the butt.
posted by Mr. Bad Example at 8:20 AM on May 12, 2010 [1 favorite]

Q: How many half way crooks does it take to change a light bulb?
A: There's no such thing as half way crooks.
posted by LouieLoco at 8:21 AM on May 12, 2010 [1 favorite]

Q: Please identify your favorite childhood pet.
A: Your mom.
posted by The Winsome Parker Lewis at 8:21 AM on May 12, 2010 [2 favorites]

Major security fail right there. Passwords should never be stored as plaintext.

So, the bank rep is going to ask it encrypted?
posted by ChurchHatesTucker at 8:22 AM on May 12, 2010 [7 favorites]

Oh, wait. I get jokes.
posted by ChurchHatesTucker at 8:24 AM on May 12, 2010

I support the effort to have something entirely nonsensical, though:

I like that, but make it like a cheesy spy movie:

Q: Why are the rains blue and alone?
A: Can't talk, throughput banana taco.
posted by grubi at 8:29 AM on May 12, 2010

Serious question: How do they verify your answer if they can't see the answer? Do they type it in to something which is verified?

Same way any half-decent password algorithm works: When setting the password, you pass it through a one-way function and convert it to a (hard to memorize, hard to decrypt) string. This is what gets stored in the database. To verify the user, you pass the answer through the same function and check that you get the same result: if you choose the one-way function correctly, you can be sure the user gave the correct password, but you still don't know what it is.

Say you want to set your password to KITTENS. At password setting time, the program calls magic_function("KITTENS"), gets back the magic key ASD90871213j1kj23h12!*@! and stores this in the database. The login program won't accept the magic string directly, so even if some attacker manages to figure out the value of the magic key, calculating that you need to enter KITTENS to get ASD90871213j1kj23h12!*@! is pretty hard, and gives you an extra layer of security.
posted by Dr Dracator at 8:31 AM on May 12, 2010 [1 favorite]

Favourite thread in ages.

I'm surprised people aren't using this as a cheap opportunity for (admittedly predictable) phone sex.

Q: Oh my god, you're getting me soooo hot. Do that again, baby. Fuck yeah, you know what I like. (etc, etc)

A: uuuuUUUUUNNNNNNGGGGHHHHHH!

Other possibilities:

Q: Would you come after me? Hunt me?
A: No, I just want my bank balance.

Q: Do you know what happens to a toad that is struck by lightning?
A: Fucking Fuck that is the stupidest line of all time.

Q: HOW'D IT GET BURNED HOW'D IT GET BURRRNEEED?!
A: *hysterical laughter*
posted by Durn Bronzefist at 8:33 AM on May 12, 2010

Q: So that one time where you said you were working late on the chesapeake bay project and then you came home at 3 am smelling like booze and perfume, what REALLY happened?
A: ENOUGH!!! I CAN'T TAKE IT ANYMORE!!!! IF YOU REALLY WANT TO KNOW THEN FINE, ME AND BARBARA SLEPT TOGETHER, WE GOT A MOTEL OFF OF 301 GOT DRUNK AND GOT DOWN. IT WAS ONE TIME 10 YEARS AGO, WE HAVEN'T SLEPT TOGETHER SINCE AND ME AND YOU WERE BARELY DATING AT THE TIME, WILL YOU PLEASE JUST LET IT GO AND STOP BRINGING IT UP, IT WASN'T EVEN THAT GOOD AND BARBARA HAS SINCE MARRIED AND HAS KIDS OF HER OWN. I'M SO FUCKING SICK OF THIS.
posted by LouieLoco at 8:37 AM on May 12, 2010

Q: Who is a great hunter and marksman?

A: Dick Cheney.
posted by oddman at 8:37 AM on May 12, 2010 [3 favorites]

Q: Describe in single words, only the good things that come in to your mind about... your mother.
A: My mother? Let me tell you about my mother.
posted by The Great Big Mulp at 8:42 AM on May 12, 2010

Major security fail right there. Passwords should never be stored as plaintext.

So, the bank rep is going to ask it encrypted?

Oh, wait. I get jokes.


Not a joke. The bank rep types your reply into the computer. It encrypts one or decrypts the other to compare them.
posted by DU at 8:45 AM on May 12, 2010

(Ack! The Man from Lardfork beat me to it.)
posted by The Great Big Mulp at 8:45 AM on May 12, 2010

So that you know you aren't getting phished.

Argh, that makes total sense.

/smacks self
posted by Civil_Disobedient at 8:50 AM on May 12, 2010

Q: Who said that? Who the fuck said that? Who's the slimy little communist shit, twinkle-toed cocksucker down here who just signed his own death warrant?
A: Sir, I said it, Sir!
posted by kirkaracha at 8:52 AM on May 12, 2010 [1 favorite]

Sidebar:

Am I the only one weirded out by the term "Maiden Name"?
No, many of us who, ourselves, have them are weirded out by the term.

Maiden names: they're not just for mothers anymore!

OK, back to your regularly scheduled making up hilarious questions.
posted by chesty_a_arthur at 9:02 AM on May 12, 2010

Q: Purple? Monkey?

A: Dishwasher.


Q: Look at me.

A: I'm on a horse.
posted by The Whelk at 9:15 AM on May 12, 2010 [1 favorite]

Q: Motherfucker talks shit?
A: Punch'em in the dick
posted by Durn Bronzefist at 9:23 AM on May 12, 2010 [3 favorites]

Q: What's your favourite brand of soap?
A: No soap, radio!
posted by Shepherd at 9:25 AM on May 12, 2010 [1 favorite]

I'd want to use snippets of famous conversations from movies where the first speaker ends up dead and the end of the exchange.

Q: Describe in single words only the good things that come into your mind about... your mother.
A: My mother? Let me tell you about my mother...

Q: Whatever I'm doing you don't like... I'll stop doing it.
A: It's not me.

or

Q: You're a goody little two-shoes! Little goody two-shoes!
A: Good, Bad? I'm the guy with the gun.
posted by quin at 9:27 AM on May 12, 2010

Q: These aren't the hammer.
A: The hammer is my penis.
posted by shakespeherian at 9:29 AM on May 12, 2010

DU: "Not a joke. The bank rep types your reply into the computer. It encrypts one or decrypts the other to compare them."

That only works if you can trust the phone rep to type it in with the exact spelling, spacing and punctuation as when you typed it in. It's one thing to be able to type in a single word password correctly each time, it's another to dictate a whole sentence over the phone and have someone else (who doesn't really care) type it in correctly character by character.
posted by octothorpe at 9:42 AM on May 12, 2010

DU, I can't speak for your bank, but there is no way in hell most of the banks and other orgs that use this store the secret answer/phrase using trapdoor encryption (as Dr Dracator correctly defines it). They may store it encrypted in some other way, but they certainly display it as plain unencrypted text to the CSR, who does NOT need to type anything in to check.

I know this because it's painfully obvious that they are LOOKING AT my answer while asking me. Otherwise they could not give me hints, let alone accept answers without me spelling them out.

And realistically, that wide-open number of ways to spell answers, including case sensitivity, makes such a system impractical here, anyway. You can only use a system like that for EXACT matches.
posted by rokusan at 9:44 AM on May 12, 2010

These have TOTALLY made me happy today. Thanks!
posted by paddysat at 9:47 AM on May 12, 2010

god this is the kind of thing I could see myself changing behind my own back while I'm drunk just to test if I'm down with my drunk sense of humor while sober.

like, I could see myself calling my bank one day only to be greeted by the question "How many licks to get to the center of a tootsie pop?"

then I'd sigh to myself, thinking "oooooookay. thanks again, drunk me. I'm so glad we've changed the security question again. well, at least this time it's not, like, the nutritional information from a pringles can again."

and then, totally not into doing this, but I'd be like "let's see. One. Two-HOOO! Three." doing the stupid owl voice in case I spelled it out phonetically so they're expecting the proper pronunciation, and feeling like a total asshole the whole time.

and then it would turn out that, ha HA, drunk me didn't think that was funny enough! nooooooo, drunk me just HAD to change it up a bit! so the answer would turn out to be something totally unguessable and vulgar, like "FUCK YOU YOU PIECE OF SHIT HOW DARE YOU !!!!ONE"

seriously, drunk me is a dick.
posted by shmegegge at 9:48 AM on May 12, 2010 [12 favorites]

DU, I can't speak for your bank, but there is no way in hell most of the banks and other orgs that use this store the secret answer/phrase using trapdoor encryption

Sorry, I didn't mean to imply that's what banks actually do. Just that that's what they SHOULD be doing and why storing in plaintext is not a joke in the sense of being unworkable. (Being a joke in the sense of lolasthough, definitely.)
posted by DU at 9:52 AM on May 12, 2010

seriously, drunk me is a dick.

O The Fucker
posted by The Whelk at 9:52 AM on May 12, 2010 [4 favorites]

Q: Tell me about your mother.

A: My mother? Let me tell you about my mother.
posted by orme at 9:57 AM on May 12, 2010

dammit, i thought i searched....oh well
posted by orme at 10:00 AM on May 12, 2010

Q: Do you Believe?
A: No! It is NOT butter!

Q:Try?
A: There is no try... only do!
posted by Debaser626 at 10:05 AM on May 12, 2010

q: Is it safe?
A: No. Yes. *bloodcurdling scream*
posted by Four Flavors at 10:11 AM on May 12, 2010 [1 favorite]

Q: How come we found this in your pocket?
A: These are not my pants.
posted by longsleeves at 10:16 AM on May 12, 2010

Q: DO YOU SEE WHAT HAPPENS LARRY?!?!
A: WHAT THE FUCK JOO DOING, MANG?! I JUS' BAWDEEZ FUCKEEN CAR LASS WEEK!
posted by clearly at 10:23 AM on May 12, 2010

Q: OK, smartass, I know that you're all into this meme-of-the-week shit that you read on some dumb fucking website somewhere, but just fucking get over yourself, OK? I am not paid to put up with this shit. Kindly allow me to repeat myself. I am not paid to put up with this shit. You've got fucking nothing better to do than make up some lame-ass bullshit script that you, you unemployed shitass hipster douchebag, are sending to me in hopes of coming up with some absurdly contrived reason to have me read it aloud, and then you'll get to utter your quote-endquote cute, quote-endquote clever retort, and you'll get those precious few moments of mild satisfaction before the overwhelming dark despair of your loneliness and the utter futility of your sad, barren existence come crashing back in. Did I get that right, Mr. Negative-Eight-Dollars-And-Thirty-Seven-Cents-In-His-Checking-Account? Is that just about the motherfucking long and cocksucking short of it?

A: Uh... you're overthinking a plate of beans?
posted by Halloween Jack at 10:29 AM on May 12, 2010 [1 favorite]

For what little it's worth, we tried setting our banking security questions' answers to random 8-character strings (generated and stored in PasswordSafe).

Silly rabbit! The way to do this is to generate random pronounceable passwords!

Simple way: take the consonants [b, d, g, h, l, m, n, p, r, t, v, z], the vowels [a, e, o, u, y]. This gives you 60 syllables with unambiguous pronunciations. Four of these give about 13 million possible passwords which is reasonably secure; by adding another optional consonant at the end and optionally removing the first one, you get about 200 million which is somewhat better.

You deliberately eliminate some letters because of ambiguity (c/k/s/i), some to avoid dirty-sounding words (f/c/k/x)... and you use y instead of i because it avoids "tit" and because, strangely, people seem to remember it better.
posted by lupus_yonderboy at 10:51 AM on May 12, 2010 [2 favorites]

I know all the movie quotes are jokes, but instead of laughing, all I can think of is "Idiots! This is LESS SECURE than your mother's name."
posted by straight at 11:18 AM on May 12, 2010 [5 favorites]

I don't know.

Q: What is your favourite colour

is probably not going to generate

A: Blue! No, wait -- pi -- AAAAIIIEEEEE!!!!
posted by Durn Bronzefist at 11:21 AM on May 12, 2010

@lupus_yonderboy: I made a spreadsheet do this for me. I also included the consonant diphthongs for additional variety. Another section of the spreadsheet chains together three words from the Linux dictionary file for a rudimentary passphrase. The system works.
posted by closetphilosopher at 12:57 PM on May 12, 2010

Q: Cake or death?
A: Death, please. No, cake!
posted by WCityMike at 1:17 PM on May 12, 2010

Q. Before your mother married your father she went by a different name. What was it?

A. Cedric.
posted by tigrefacile at 1:26 PM on May 12, 2010 [1 favorite]

Screw favorites. I'm bookmarking this thread to use as my password generator.
posted by rokusan at 1:51 PM on May 12, 2010

Q: Would you like to hear one of my poems?
A: Long ago, the delicate tangles of his hair covered the emptiness of my hand.


Of course there's the always brilliant Aaron Sorkin whose dialogue is full of wonderfully obscure quotes...

Q: You want to make out with me right now, don’t you?
A: Well, when don't I.

Q: So, uh... You’re probably wondering what all this has to do with social equality?
A: No. I’m wondering where France really is.

Q: What’s his problem?
A: He’s been drinking from the keg of glory. We’re to bring him all the muffins
and bagels in the land.
posted by ApathyGirl at 2:50 PM on May 12, 2010 [2 favorites]

to have an unrelated answer

Yeah, I tried that, and I forgot the answer. Might as well just write down your password.
posted by Jimmy Havok at 3:22 PM on May 12, 2010

Q: Who is this? What's your operating number?
A: Boring conversation anyway.
posted by The Bellman at 3:26 PM on May 12, 2010 [1 favorite]

The bank rep types your reply into the computer.

And that's the end of your vaunted security, since the bank rep now knows your password.

However, the system does keep people from doing a lookup on your password without your knowledge.
posted by Jimmy Havok at 3:41 PM on May 12, 2010

My bank has this.

My question is, 'Who is the most unpleasant person you know?'

Since I know so many unpleasant people, even my very closest friends and relatives would never guess it! It is foolproof!

There is always a pause when I call them as the CSR reads it and quite audibly tries not to giggle.
posted by winna at 4:23 PM on May 12, 2010

Q: You like sex? You are a person who likes the sex acts that we are currently engaged in as much as a prostitute likes sex?
A: Yes! I am! I like sex! I LIKE SEXY SEX AS IF IT WERE MY PROFESSION!!
posted by Busy Old Fool at 5:40 PM on May 12, 2010 [3 favorites]

Q: Open the pod bay doors, HAL.
A: I'm sorry, Dave. I'm afraid I can't do that.
posted by Multicellular Exothermic at 6:09 PM on May 12, 2010

Q: Why did you resign?
A: I AM NOT A NUMBER!!! I AM A FREE MAN!!


Q: You wanna bust a nut in me, Killer?
A: AW SHIT....YOU KNOW I DO!!
posted by Skygazer at 6:12 PM on May 12, 2010

Q: SOYLENT GREEN, IS IS IS....PEOPLE? ?!!
A: YES!! SOYLENT GREEN IS PEOPLE....IT'S PEOPLE!!
posted by Skygazer at 6:15 PM on May 12, 2010

Q: Who shot first?
A: VHS version or DVD version?
posted by Kirth Gerson at 6:29 PM on May 12, 2010

Q: Have you ever transcended space and time?
A: Yes. No. Uh, time, not space. No, I don't know what you're talking about.
posted by puddleglum at 7:08 PM on May 12, 2010

Q: Have you had it with these motherfucking snakes on this motherfucking plane?

Someone help me with a funny answer.
posted by uncanny hengeman at 7:49 PM on May 12, 2010

uncanny hengeman: Q: Have you had it with these motherfucking snakes on this motherfucking plane?

Someone help me with a funny answer.

A: No, I have had it with these monkey-fighting snakes on this Monday-to-Friday plane.
posted by WCityMike at 7:54 PM on May 12, 2010

Q: O RLY?
A: YA RLY
posted by armage at 8:14 PM on May 12, 2010

Be careful, since the answer has to be exact. At least if the CSR can't see the real passphrase. I once put in "What are you wearing?" as my question. Turns out "I don't think that's appropriate" wouldn't work; nor would "That's inappropriate." The correct answer, "matching bra and panties" had to be spelled exactly correctly.
posted by faceonmars at 8:58 PM on May 12, 2010

Q: Do u leik mudkips?
A. Newfags can't triforce.
posted by Multicellular Exothermic at 9:06 PM on May 12, 2010

Q: What is the name of the person you wish to call?
A: Upgrayedd.
posted by raysmj at 12:29 AM on May 13, 2010 [1 favorite]

Q: Nose army. Beef diaper?
A: Nomenclature.
posted by hilaritas at 6:30 AM on May 13, 2010 [1 favorite]

Q: Who is Number One?
A: You are Number Six
posted by Len at 8:15 AM on May 13, 2010 [3 favorites]

My friend worked at a place that used this type of security question. One day a woman called up to access her account, and he said, "This is what you put down for your security question, so I have to ask you - are you an idiot?".

The woman replied, "No, I'm not an idiot".

So he had to say, "I'm sorry - that's not the correct answer", and hang up.
posted by Gortuk at 9:01 AM on May 13, 2010 [3 favorites]

Q. How many angels can dance on the head of a pin?
A. Wait. What?
posted by beelzbubba at 10:18 AM on May 13, 2010

Q. Can you hammer a six-inch spike through a board with your penis?
A. Not right now...

Q. You remember the name of the town, don't you?
A. Zihuatanejo

Q. If you inherit five million dollars the same day aliens tell the earth they're blowing us up in two days, what would you do?
A. That's the stupidest question I've ever heard!

Q. Do you know the difference between brown-nosing and ass-kissing?
A. Depth perception.

Q. As you know, the concept of the suction pump is centuries old. Really that's all this is except that instead of sucking water, I'm sucking life. I've just sucked one year of your life away. I might one day go as high as five, but I really don't know what that would do to you. So, let's just start with what we have. What did this do to you? Tell me. And remember, this is for posterity so be honest. How do you feel?
A. [whimpering sound]
posted by samsara at 10:51 AM on May 13, 2010

Q. Do you know the difference between brown-nosing and ass-kissing?
A. Depth perception.

I heard that one originally as the difference between a brown-noser & a shit-head.

On a related note to this whole thread--one of my bank's security questions involves the first name of a relative. I found out through a recent genealogical search that a person I knew forever as "X" was really named "Y." Do I have to fill out my security questions again? What if I answer truthfully now, even though my answer won't match? Does my bank know? Do I have to tell them?
posted by beelzbubba at 11:53 AM on May 24, 2010