12

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions.

There is even a dedicated page about what information to gather.

Whenever I see such a "feature" on a web site it strikes me as unbelievably insecure for most users, because most users will choose a question an answer that is probably very easy to find out by anyone who knows the person a bit. So I was very surprised to see such a recommendation on OWASP.

Is it really a good idea to implement security questions?

3
  • From what I can see, the security question is proposed as a first step process to immediately disable the current password and force 2FA
    – timuzhti
    Commented Nov 18, 2015 at 7:23
  • 1
    There is a discussion page which might be a better place to ask: owasp.org/index.php/Talk:Forgot_Password_Cheat_Sheet
    – lorenzog
    Commented Nov 18, 2015 at 13:31
  • It seems that OWASP no longer recommends this. In the second link mentioned in the question, this text can be found now: WARNING: Security questions are no longer recognized as an acceptable authentication factor per NIST SP 800-63. Account recovery is just an alternate way to authenticate so it should be no weaker than regular authentication.
    – hb20007
    Commented May 30, 2023 at 11:05

1 Answer 1

11

Specifically with regards to security questions you are asking users to share potentially sensitive facts about themselves that are likely obtainable by social engineering of people near them. That makes security questions at best inadvisable and at worst downright dangerous from a holisic security perspective.

OWASP, while good overall for explaining the problems, makes many inadvisable recommendations including security questions, input whitelisting, and XXE mitigations that prevent loading most XML documents. Take the problem descriptions as they are, but really scrutinize their solutions before considering implementing them.

4
  • 4
    Specifically, what is wrong with input whitelisting? It is a valid and useful technique in many places. Commented Nov 18, 2015 at 13:55
  • 3
    @Cybergibbons it has occasional merit. I have trouble recommending it in places like passwords where it both makes the user experience annoying and reduces the security of passwords. It's also annoying in free text entry. It makes sense to do type-safe input validation (numbers are whitelisted to numbers and bounded if needed), but I think whitelisting of free text is often never desirable. In many cases I've seen whitelisting used where prepared statements and output encoding are the actual solutions. Commented Nov 18, 2015 at 18:12
  • 1
    Ah, ok, so it's more that it is used as an inappropriate solution, or where it is an annoyance. Yes, that makes sense. Commented Nov 19, 2015 at 10:49
  • @Cybergibbons: I see whitelisting as a comfort solution: warning that an email address has no @(and nothing more), making sure a number is a number - all the things which would make the submission fail when checked server-side. In no case it can be a security feature.
    – WoJ
    Commented Mar 13, 2019 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .