Every once in a while I have to set up an account on a site that, while apparently at least not storing my password in plaintext, still force me to choose from a limited set of security questions that can be used for password recovery purposes. Since the questions are usually moronically easy to answer by some googling or social engineering (à la "What's you mother's maiden name?") what is the correct approach when I cannot avoid using this account?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|
"Security questions" are just an alternative password which is not used often, but which, presumably, will not be forgotten by the user. Since it is a password-equivalent information, treat it as such: use true, high-entropy passwords as answers to security questions. Of course, since you will not enter these often, you should write them down on a paper, stored in a safe place (they are meant to be used as a backup for the "true" password; you do not need them often). (Note: most systems will handle responses to security questions in a case-insensitive way, which decreases the "entropy" of that password -- hence, make it even more random. 15 random letters would be enough.) |
|||||||||||||||
|
|
My current "solution" is entering an arbitrary long senseless sentence that I don't even intend to remember and instead store that and my password in (separate) KeePass files, and maybe complaining to the webmaster about this. That way it's unlikely someone else can answer the "secure" question without any less effort than attempting to directly crack my password, but I'm still not too happy with this... |
|||
|
|
|
I have seen various people just fill in all these with junk, to ensure that no-one can use them to socially engineer access. It does mean that you will need to be extra careful not to forget your username/password, as you may have no fall back route :-) |
|||||
|
|
Think of a list of questions you think are good security questions for you. Use these at the better sites that allow you to phrase your own security questions. Eg Ben's car in HS?. For the sites with the moronic questions (eg mother's maiden name), map their questions to your questions. So answer to Mother's Maiden name may be '1960' (since what I remember was how ancient Ben's car was). You could use the same mapping each time (ie maiden name always maps to 1960) or you mix them up and just keep the 'key' (ie which moronic question goes with which real question). The issue with a shared secret is that it can't be a secret if it's public. What the above allows you to do is move the 'secret' to being the question mapping. |
|||||||||
|
