Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I'm building a secure password recovery feature similar to the one described here.

During the final phase of the password recovery, the user is asked a recovery question to verify their identity.

Does anyone know where I could find a list of sample recovery questions? Ideally these questions would either be vetted for culture sensitivity, or if it's possible, also be humorous in nature (relating to the theme of the website)

share|improve this question
3  
I always type in garbage for the sample questions... and my bank doesn't like this. – Rook Aug 6 '12 at 18:16
4  
Just let the user supply their own questions. This seems like something you could easily com up with, in 5 minutes, we all have been asked these questions hundreds of times. – Ramhound Aug 6 '12 at 19:15
Definitely, give the user an option to pick their own security questions (possibly with a list of suggestions); but preferably use other factors (e.g., phone number + email) to do password resets (as well as requiring reinputting credit card #s). Apple recently forced me to choose security questions from a list, where for most I didn't have a good answer that I will later recall.(Don't own a car; have had multiple favorite/least teachers and jobs (no clear winners); first album/concert is not clear cut.) – dr jimbob Aug 6 '12 at 21:33
As a user, I MUCH prefer to come up with my own question. I can come up with something that is not recorded anywhere and highly specific to me. – schroeder Aug 8 '12 at 14:33

2 Answers

up vote 5 down vote accepted

Try the following: goodsecurityquestions.com - it provides a list of good and bad examples, along with guidelines on how to think about security questions. They also state that their guidelines have been used by Prudential, Delta Airlines, American Express and ING Direct.

Interesting quote from the site:

However, there really are NO GOOD security questions; only fair or bad questions. "Good" gives the impression that these questions are acceptable and protect the user. The reality is, security questions present an opportunity for breach and even the best security questions are not good enough to screen out all attacks. There is a trade-off; self-service vs. security risks.

share|improve this answer
4  
Welcome to Stack Exchange. Please provide context for links. Summarize the important information in your own words, and provide the link for further reference. – Gilles Aug 7 '12 at 9:57
1  
@Gilles, while I generally agree with that advice, in this case I think it amounts to asking me to "pad" my answer with content-free filler. The rules of thumb for this site should be, well, rules of thumb -- not something you should follow blindly without any thought. The poster asked for a list of sample security questions; I point to a list of sample security questions. Are you really telling me you would prefer have no answer at all, than an answer that concisely and effectively meets the poster's need? – D.W. Aug 7 '12 at 19:04
fixed for you D.W. – Rory Alsop♦ Aug 7 '12 at 19:27
@D.W. See Rory's edit: he added a quick description of the site and an important piece of advice. This turns your post from a link with no information into a helpful answer. – Gilles Aug 7 '12 at 19:39
show 1 more comment
up vote 4 down vote

The challenge questions are often the weakest part of an online password mechanism - forcing 'mother's maiden name' or 'first school' or even 'pet's name' makes it very easy for an attacker, as this information is often public.

In principle allowing the users to choose their own questions could give you a bit more security - if they are savvy enough not to use the standard questions, which in my experience, they aren't!

I like Rook's answer - type random garbage, but remember what the answer should be: this will make it difficult for an attacker.

Or type in garbage for the question and answer - this forces password reset to have to use alternate routes (such as using a phone challenge, or visiting the bank etc), which could make it even harder for an attacker.

share|improve this answer
In the article I linked my question to, the author recommends a SMS / out of band validation and an optional Q&A section. (see flowchart at the bottom). The threat I'm trying to mitigate is where someone borrows an unlocked phone, sees the SMS and resets the password. I need a "something you know" component that isn't the account number. – makerofthings7 Aug 7 '12 at 13:56
"Allowing the users to choose their own questions gives you a bit more security" - Are you aware of any evidence of this? I have to admit I am skeptical, given what I know about the level of understanding of security principles held by most users. – D.W. Aug 7 '12 at 19:06
I guess I should have written "could give you..." but the rest of that sentence does agree with you - in reality end users will break the potential benefits. – Rory Alsop♦ Aug 7 '12 at 19:16
Makes sense! I made a proposed edit based upon your comment -- take a look and see if it more accurately reflects your intent or not, and if not, roll it back! – D.W. Aug 8 '12 at 3:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.