Context
We have a situation where we are allowing our users to login using either using Username & password + Memorable word OR Username & Password + answer to Security questions depending on configurable options by the client.
When user requests a password reset they are sent an email and linked back to a password reset workflow.
I fully understand that both memorable word & answers to security questions are sub-optimal solutions at best.
A couple of questions:
- when a user initiates a password reset should they be required to reset answers to their security questions & Memorable word as well?
- Given that both additional steps ( either answers to security questions or Memorable word) are actually less secure than username & password what are the merits of reseting them?