Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Do security questions subvert passwords?

Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he could answer the security question, that he provided before, and then he could change his password. BUT: isn't this a security issue? What happens when the security question is weak, and guessable?

share|improve this question

marked as duplicate by Iszi, Jeff Ferland, nealmcb, Mark Davidson, Rory Alsop Jun 3 '11 at 23:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 3 down vote accepted

Usually security questions are not used by themselves and are used to accompany email verification. Some services also use them when your logging in from a different location to normal to add to the login process. Using them by themselves, unless you're asking like 50 questions, can be a security issue.

Whatever you do they can still be weak and guessable so the right questions have to be used. There is a list of good security questions here which are supposed to be more difficult to guess.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.