My Yahoo account was hacked and I am very worried about why. They said I was more secure after removing my additional security questions. Is that correct?
Disclosure: I work for AgileBits, the makers of 1Password, a password manager.
Security questions are terrible. In fact, pretty much everyone who studies these calls the insecurity questions.
First of all security questions are another way into your account. But let's compare their security properties with passwords.
Security answers are not secret
My mother's maiden name is not a secret. Nor is the street where I lived as a kid, nor are so many of the other things that are routinely asked. Sure, some of them may not actually be public knowledge, but if I have to use my father's middle name, I don't want to then be responsible for keeping that secret in the future.
Security questions are stored unencrypted
Passwords have to match exactly because they are typically hashed, but security questions are looked at by humans, so if I answered "walter" for my father's middle name (see, it is no longer a secret), I would be allowed back in with "Walter". But in terms of passwords almost doesn't count:
$ echo walter | shasum 95ea07881ac3ffe8602879232682052c3e93b6d8 - $ echo Walter | shasum f82f03f4a76873ff4ae41d6609b99f258a647b82 -
And so insecurity questions are stored unencrypted. Yahoo! did a nice job with using bcrypt to hash the passwords (making it harder for the people who stole those hashes to make guesses at passwords), but the thieves got the security questions.
This also means that the people who manage the system also know your security questions and answers. It's not just external thieves, but internal ones as well who can learn these.
Insecurity questions are even more likely to be reused than passwords.
The people who got hold of the insecurity questions (and answers) can now uses those answers to attack your account on other sites you use those answers for. If you give your father's middle name as "walter" on one site, you are likely to give the same answer to the same question on another.
This, of course, is true of passwords, which is why you should use a separate password for each site and service. If you used a decent enough password, than Yahoo!'s use of bcrypt will mean that many reasonably strong passwords will remain unguessed. So the bad guys may not know your Yahoo! password, but they do know your security question answers. (But do not use things that you would like to keep secret for security questions. Remember that in the best case only the people who operate the service will see them.
Security questions (answers) are less varied than passwords.
The most common 100 pets names are almost certainly going to be more common than the most common 100 passwords.
Almost all of the problems about security questions listed above are a consequence of what they are designed to do. They are designed to be things that you already remember (instead of a new thing you have to remember like a password. And you remember these things because they are the truth. So true things about you are less likely to be secret and there are many more ways to lie than to tell the truth. So the inherent problem with insecurity questions follow from their design.
I'm quoted in an a recent article at WIRED that covers these and points to other resources as well.