From: Arthur Chandler <arthurc@crl.com>
Date: Mon, 1 Nov 93 16:22:40 PST
To: cypherpunks@toad.com
Subject: Your mother's maiden name
In-Reply-To: <UgpMbJO00VomMPJkcJ@andrew.cmu.edu>
Message-ID: <Pine.3.87.9311011635.A18061-0100000@crl.crl.com>
MIME-Version: 1.0
Content-Type: text/plain



 At least three places/organizations I do business with ask for this bit 
of info as a "security check." The idea being, I think that you mother's 
maiden name is something that only those intimately familiar with your 
family would know, and therefore is an easy, universally applicable kind 
of "password" to be used before handing out sensitive info.
 But I've always wondered just how secure this "password" is. Recalling 
Eric Hughes statement that "cryptography is all economics," and 
realizing that someone with an unlimited budget could probably scrounge 
that info after some effort -- just how much effort would it take? And 
how secure is "mom's maiden name" as a password for obtaining sensitive 
information over the phone?