I use a website that on top of requiring a username and password also requires 'memorable information'.

When signing up I provided multiple pieces of memorable info as answers to multiple questions (E.g. Memorable Place, Date etc.)

When signing in I'm not asked for a specific piece of memorable info (as expected) but for any of them. I can sign in with the same piece of info every time without ever knowing what the other answers are.

Is this a poor or incorrect implementation of having memorable information?


I agree, that seems dumb.

The general consensus is that there are three types of authentication mechanisms:

  1. Something you know (ie password).
  2. Something you have (ie code generating app, access to an email account, ability to receive SMSs, etc).
  3. Something you are (ie fingerprint or iris scan).

There's really no reason to ask for more than one thing from each category. Proper 2-Factor Authentication ("2FA") systems will always ask for two things from different categories. What you've described (and in fact all "memorable info" systems) are really just two passwords... I agree that this seems kinda useless.

  • As mentioned by @MikeOunsworth, these systems aren't great when well implemented, and this one additionally has been poorly implemented. If using this type of verification, any given session should only provide the same question to prevent the specific attack you suggest – Matthew Apr 5 '16 at 18:28

Does having multiple 'memorable info' answers reduce secuity?

Yes (See Caveats). Security Questions are not a great method for security. To date, the security landscape is very much moved from Send and Pray attacks, to Targeted Social Engineered tactics and attackers are motivated to dig into the personal lives of people to get at your goods.

By Why?

Firstly, the implementation of Security Questions are often the relied on method for protecting forgotten/lost password/usernames. It's neither challenging nor complicated to get answers from somebody as social media is so prevalent and our psychology is such that we'd rather give people the benefit of the doubt rather than malicious intent.

Second, (As a Developer) many developers don't actually understand the process of security, the real meanings of Authentication, Authorization, and Identity, or understand the difference between Multi-Factor Authentication (MFA) and Two-Factor Authentication (2FA). Security Questions try to provide MFA, but to average coders actually end up providing a mechanisms for attackers to by-pass the whole needing a password thing.


Since, I work in the banking sector and in IS, counter point to my opinion, I will note that it's not uncommon for Banks/Companies to use a Security Question for MFA on items like logging in from unknown devices or locations and preventing session hi-jacks by coupling them with pre-selected pictures. Their intent is not around password resets, but truer MFA reasoning in that if you know your username, and know something about you (E.G Your first dogs name) than the person trying to login from an unknown location (unknown to the bank) is a higher chance of being you and should proceed. There is more reasoning behind it but yeah.

  • You mistake MFA. It must be something you know plus something you are or have. Security questions are unrelated to MFA. You are making the same mistake the software authors made. – Neil Smithline Apr 6 '16 at 5:05
  • That's not true. MFA is Multi-Factor, Two passwords can be Multi-Factor, Two Factor (2FA) is what you are describing. – Shane Andrie Apr 6 '16 at 20:50
  • What would call Finger Print, and Retina scan combos? They are both Bio-Metrics using two of the same Factor (something you are). Or more common, User Authentication, and Break Glass Authentication. Both are password based (using the same factors), and we still call it multi-factor. That's why I have 2FA in the post, as MFA basically describes anything we want to do with Auth. – Shane Andrie Apr 6 '16 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.