Skip to main content
edited tags
Link
Mike Ounsworth
  • 59.3k
  • 21
  • 162
  • 214
Source Link
Okavango
  • 415
  • 1
  • 4
  • 11

memorable word and answers to security questions when resetting password?

Context

We have a situation where we are allowing our users to login using either using Username & password + Memorable word OR Username & Password + answer to Security questions depending on configurable options by the client.

When user requests a password reset they are sent an email and linked back to a password reset workflow.

I fully understand that both memorable word & answers to security questions are sub-optimal solutions at best.


A couple of questions:

  1. when a user initiates a password reset should they be required to reset answers to their security questions & Memorable word as well?
  2. Given that both additional steps ( either answers to security questions or Memorable word) are actually less secure than username & password what are the merits of reseting them?