I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are:
- What is your name? John
- Where do you live? Chicago
To reset, I'm prompted to answer both questions; however, it doesn't matter which answer I use for which question, so long as the answer I use is correct for at least one question. All of these combinations work:
John/Chicago, Chicago/John, John/John, Chicago/Chicago
If either field is an incorrect answer to either question, the page returns an error, so
John/-incorrect-, -incorrect-/John, Chicago/-incorrect-, -incorrect-/Chicago
This must be a bug, right? It seems like an almost deliberate "convenience feature" that actually dramatically reduces the already-limited effectiveness of the security questions.