Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm building a secure password recovery feature similar to the one described here.

During the final phase of the password recovery, the user is asked a recovery question to verify their identity.

Does anyone know where I could find a list of sample recovery questions? Ideally these questions would either be vetted for culture sensitivity, or if it's possible, also be humorous in nature (relating to the theme of the website)

share|improve this question
3  
I always type in garbage for the sample questions... and my bank doesn't like this. – rook Aug 6 '12 at 18:16
4  
Just let the user supply their own questions. This seems like something you could easily com up with, in 5 minutes, we all have been asked these questions hundreds of times. – Ramhound Aug 6 '12 at 19:15
    
Definitely, give the user an option to pick their own security questions (possibly with a list of suggestions); but preferably use other factors (e.g., phone number + email) to do password resets (as well as requiring reinputting credit card #s). Apple recently forced me to choose security questions from a list, where for most I didn't have a good answer that I will later recall.(Don't own a car; have had multiple favorite/least teachers and jobs (no clear winners); first album/concert is not clear cut.) – dr jimbob Aug 6 '12 at 21:33
    
As a user, I MUCH prefer to come up with my own question. I can come up with something that is not recorded anywhere and highly specific to me. – schroeder Aug 8 '12 at 14:33
    
Theres good evidence that people make up bad questions, such as "What bank is this" or "what is my name", I think it was a paper by Joe Bonneau. – Adam Shostack Jan 28 at 17:29
up vote 7 down vote accepted

Try the following: goodsecurityquestions.com - it provides a list of good and bad examples, along with guidelines on how to think about security questions. They also state that their guidelines have been used by Prudential, Delta Airlines, American Express and ING Direct.

Interesting quote from the site:

However, there really are NO GOOD security questions; only fair or bad questions. "Good" gives the impression that these questions are acceptable and protect the user. The reality is, security questions present an opportunity for breach and even the best security questions are not good enough to screen out all attacks. There is a trade-off; self-service vs. security risks.

share|improve this answer
4  
Welcome to Stack Exchange. Please provide context for links. Summarize the important information in your own words, and provide the link for further reference. – Gilles Aug 7 '12 at 9:57
    

The challenge questions are often the weakest part of an online password mechanism - forcing 'mother's maiden name' or 'first school' or even 'pet's name' makes it very easy for an attacker, as this information is often public.

In principle allowing the users to choose their own questions could give you a bit more security - if they are savvy enough not to use the standard questions, which in my experience, they aren't!

I like Rook's answer - type random garbage, but remember what the answer should be: this will make it difficult for an attacker.

Or type in garbage for the question and answer - this forces password reset to have to use alternate routes (such as using a phone challenge, or visiting the bank etc), which could make it even harder for an attacker.

share|improve this answer
    
In the article I linked my question to, the author recommends a SMS / out of band validation and an optional Q&A section. (see flowchart at the bottom). The threat I'm trying to mitigate is where someone borrows an unlocked phone, sees the SMS and resets the password. I need a "something you know" component that isn't the account number. – LamonteCristo Aug 7 '12 at 13:56

First, don't think about password recovery, think about account recovery. (Password recovery leads to wanting to store passwords in plaintext, which is bad.)

Second, there are many good critiques of these questions out there. You should ask, why use them at all?

The right answer depends on how well you know your customers. A bank might use an ID check, while a low barrier to entry service like Twitter or instagram might use a challenge sent to the customer's email.

In any event, the more your backup authentication uses details that are known only to you and your customer, the more secure (and potentially usable) it will be.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.