3

From my own reading, security questions on websites seem to have a reputation in the industry for being outdated and insecure, the basic information they need being easily available to anyone who can Google, unlike in the '80s when they were first developed for the banking field.

However, it occurs to me that a huge part of this has to be due to the fact that most security questions are canned and re-used on virtually every site that uses them, thereby hugely narrowing the list of potential answers. Surely, giving users the option to create their own custom security questions with custom answers would solve this problem? I know I'd be a lot more likely to remember an answer to a basic question I devised myself, and a hacker is less likely to be able to find out what my favourite car is than my mother's maiden name. So why isn't this common practice in the industry, and why do web apps insist on using the same canned questions?

Improve this question
  • Why isn't it common practice in industry? can e answered with a simple: because there are alternatives or because people implement it that way or even monkey and ladder. Instead I'll argue about why are you arguing this is common in industry in general. I'll say that it is common in a specific niche, whilst industry giants (google, facebook) abandoned security questions a good time ago. A question about a specific industry niche will give better answers. – grochmal Oct 16 '16 at 23:16
  • Now that I think about it, I suppose you're right that most of the big/newer sites I've come across have migrated to using email resets. Is that the alternative you were referring to? Are there any other alternatives? Are email resets currently the most secure? – Hashim Aziz Oct 17 '16 at 3:02
  • The very fact that you would be a lot more likely to remember the answer is the same reason why it may be less secure. People would choose things like "who is the most awesome NFL player?", or "what's the best car in the world?", and then provide the answers plastered all over their social media posts. If you get around this by forcing the user to memorize both the question and answer, then they will invariably get the wording wrong. i.e. "who is the greatest NFL player?" – user1751825 Oct 17 '16 at 4:20
  • 3
    I've seen people choose questions like "Is your password 'GoCubs111'?" or "The answer to the question is 'DallasCowboys'". It saves them the trouble of having to remember yet another stupid password from yet another stupid web site. Allowing free-form questions is not a cure-all. – John Deters Oct 17 '16 at 20:45
3

The main problem with security questions is how easy it can be to obtain the answers, no matter what the actual question is.

You've raised 2 examples which sound equally as bad to me:

  • Favorite car: Can be extremely trivial to obtain. What if you know the person's username which he also uses on a car forum which turns out to display what his favorite car is?
  • Mother's maiden name: We're in an era where people mindlessly share personal information through social media. Depending on the system, it could be very easy to figure out the person's name and a quick browse on their Facebook page could reveal this information.

Also, these are highly vulnerable to social engineering attacks. Let's take an online multiplayer game for example. A user could casually ask you questions and then without noticing, you could be answering questions that would allow the user to recover your account.

Finally, letting the user decide the question is a huge responsibility that he most-likely wouldn't be aware of. You can't expect the user to enter a question that nobody will ever know the answer of when passwords such as Password1 can still be seen in the wild.

To conclude

For these reasons, it is hard to justify the use of security questions and would suggest to implement email recovery instead, which requires the attacker to either control your email address or successfully conduct phishing to recover your password.

Improve this answer
  • I really wouldn't agree that someone's favourite car is equally bad a security question as mother's maiden name. The latter is personal information that's rarely exposed to the outside world, known only to the individual and the few that know him well, and would be revealed to an unrelated attacker in the very specific, very unlikely circumstances you describe. Finding the former, conversely, involves only basic familiarity with or cursory research of the target, and once found, can be re-used again and again to obtain access to other websites the target uses. Completely false equivalency. – Hashim Aziz Oct 17 '16 at 3:04
  • Also the equivalency misses the point of the latter - its security comes from the fact it isn't a question about the user's favourite car, but its uniqueness; a "favourite car" is the least secure it can be, while the mother's maiden name only ever has the security it's always had, which is next to none. – Hashim Aziz Oct 17 '16 at 3:06
  • Upvoted because you make a completely separate point that I hadn't considered - the need for security questions at all. It's only now just occured to me that my question is a sort of straw man - I hadn't really realised that the big players in the industry had already moved towards email resets. I suppose my current line of thought at the moment, then, is that the level of security - from most to least secure - goes: Email resets -> Custom security questions -> Canned security questions. – Hashim Aziz Oct 17 '16 at 3:10
  • Sorry, I missed your point about the problem of letting the average user decide. I kinda figured that would be the main answer I'd get, that the average user out in the wild can't be trusted to set their own security questions, and it's a good point. Maybe the answer is that custom security questions are a security luxury that should only be implemented for user bases that can be "trusted" to be mindful about their security; web apps that boast tech-savvy users. – Hashim Aziz Oct 17 '16 at 3:15
  • 2
    Your mother's maiden name is a matter of public record and easy to look up. With the right pieces of info, I can get it straight from Facebook, even ... – schroeder♦ Jan 4 '18 at 14:37
1

Why can't users define their own questions?

Custom security questions are an issue because users are bad at choosing questions.

For example

  • Question: Who is your favorite Beatle?
  • Answers: John, Paul, Ringo, or the other guy
  • Problem: Insufficient variety (there are only four possible answers)

or

  • Question: Where were you born?
  • Answers: Boston MA, Boston Massachusetts, Boston Mass, Boston General Hospital
  • Problem: System cannot deterministically match answer stored with answer supplied

or

  • Question: What is your date of birth?
  • Answer: Pretty straightforward
  • Problem: Answer may be stored in cleartext (in order to support phone authentication with a CSR) which would not be in PCI-DSS compliance.

Why do we tolerate security questions, which are obviously not a very good solution?

MFA was introduced via revised FDIC guidance in 2005. Banks were under a lot of regulatory pressure to get MFA systems in place by EOY 2006. The cheapest and easiest thing to do was introduce security questions and answers, but they are not ideal. These days, newer online banking implementations will use out of band OTP instead, such as a code that is sent to your mobile phone.

If my bank still uses security questions, am I at risk?

All this doesn't necessarily mean that a banking site that uses security questions is putting you at a terrible risk. Dangerous transactions, such as external transfers, are typically guarded by other stuff, such as a rules-driven fraud detection engine, back office auditing, and clawback provisions.

Regardless, the risk of monetary loss is on the bank, not on you.

Improve this answer
1

Your question assumes that there is such a thing as a Good security question. I'd argue that there isn't such a thing. This has always been true but today's connected world and social networks make it readily apparent.

A good security question would require an answer that is not easily known or discoverable, not subjective, static, have a clear single answer and applicable. The reasons for those requirements should be fairly obvious but a security question is no good if it isn't a secret or depends on your mood that day or changes over time, has multiple possible answers or just doesn't apply to someone.

This eliminates pretty much anything about your family (mothers maiden name, birthdays etc) as this is readily discoverable even if you don't post it yourself on social networks. It also eliminates your favorite XYZ as favorites are subjective and change over time. You can also eliminate the color of your first car as that may be readily available information, not apply to many people or even not have a clear single answer. Is the car grey or Arctic silver or metallic silver grey? Pretty much everything you can come up with will fail one or more of these tests even if you are trying to come up for questions yourself.

Even if you do let people pick their own questions and they do come up with reasonable good ones odds are they would just start reusing them across multiple sites and the first breach that came around would have them in clear text in the database and they'd no longer be good security questions.

Improve this answer
-2

The questions may be generic, but the answers need not be. If you use a password manager application, and you strictly adhere to a robust password management process, then you could use randomly generated answers.

For a question like "what was the make of your first car?" instead of putting "Ford", you would put something like "hIUYkjh7657".

No amount of social media trawling will get a would-be hacker anywhere near the answer.

Improve this answer
  • This isn't an answer to the question. I'm aware of how I, personally can make security questions more secure. Also, as an aside, this "trick" is bad practice because it entirely defeats the purpose of a security question. A security question is meant to provide the right amount of balance between security and ease-of-remembering. If your users are having to use this trick to make their answers secure, you may as well do away with the question completely and implement a "recovery-only" password, because that's what this trick essentially is. – Hashim Aziz Oct 17 '16 at 3:47
  • I use this trick where necessary to get through registration screens that force me to use reminder questions. If you implement custom questions, users will forget their questions. It provides little additional security, and could potentially create more support hassles. – user1751825 Oct 17 '16 at 3:57
  • 1
    Custom questions could actually make an account less secure, as the questions are more likely to have a direct association with the user, and therefore the answers could more easily be gleaned from social media. – user1751825 Oct 17 '16 at 4:11
  • I discuss this tactic on michael.kjorling.se/computers/passwords#secret-questions. Yes, I believe it's a good idea. No, I do not believe this provides an answer to the question as asked. – user Oct 17 '16 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.