Why don't web apps use custom security questions?

Question

From my own reading, security questions on websites seem to have a reputation in the industry for being outdated and insecure, the basic information they need being easily available to anyone who can Google, unlike in the '80s when they were first developed for the banking field.

However, it occurs to me that a huge part of this has to be due to the fact that most security questions are canned and re-used on virtually every site that uses them, thereby hugely narrowing the list of potential answers. Surely, giving users the option to create their own custom security questions with custom answers would solve this problem? I know I'd be a lot more likely to remember an answer to a basic question I devised myself, and a hacker is less likely to be able to find out what my favourite car is than my mother's maiden name. So why isn't this common practice in the industry, and why do web apps insist on using the same canned questions?

Answer 1

The main problem with security questions is how easy it can be to obtain the answers, no matter what the actual question is.

You've raised 2 examples which sound equally as bad to me:

• Favorite car: Can be extremely trivial to obtain. What if you know the person's username which he also uses on a car forum which turns out to display what his favorite car is?
• Mother's maiden name: We're in an era where people mindlessly share personal information through social media. Depending on the system, it could be very easy to figure out the person's name and a quick browse on their Facebook page could reveal this information.

Also, these are highly vulnerable to social engineering attacks. Let's take an online multiplayer game for example. A user could casually ask you questions and then without noticing, you could be answering questions that would allow the user to recover your account.

Finally, letting the user decide the question is a huge responsibility that he most-likely wouldn't be aware of. You can't expect the user to enter a question that nobody will ever know the answer of when passwords such as Password1 can still be seen in the wild.

To conclude

For these reasons, it is hard to justify the use of security questions and would suggest to implement email recovery instead, which requires the attacker to either control your email address or successfully conduct phishing to recover your password.

Answer 2

Why can't users define their own questions?

Custom security questions are an issue because users are bad at choosing questions.

For example

• Question: Who is your favorite Beatle?
• Answers: John, Paul, Ringo, or the other guy
• Problem: Insufficient variety (there are only four possible answers)

or

• Question: Where were you born?
• Answers: Boston MA, Boston Massachusetts, Boston Mass, Boston General Hospital
• Problem: System cannot deterministically match answer stored with answer supplied

or

• Question: What is your date of birth?
• Answer: Pretty straightforward
• Problem: Answer may be stored in cleartext (in order to support phone authentication with a CSR) which would not be in PCI-DSS compliance.

Why do we tolerate security questions, which are obviously not a very good solution?

MFA was introduced via revised FDIC guidance in 2005. Banks were under a lot of regulatory pressure to get MFA systems in place by EOY 2006. The cheapest and easiest thing to do was introduce security questions and answers, but they are not ideal. These days, newer online banking implementations will use out of band OTP instead, such as a code that is sent to your mobile phone.

If my bank still uses security questions, am I at risk?

All this doesn't necessarily mean that a banking site that uses security questions is putting you at a terrible risk. Dangerous transactions, such as external transfers, are typically guarded by other stuff, such as a rules-driven fraud detection engine, back office auditing, and clawback provisions.

Regardless, the risk of monetary loss is on the bank, not on you.

Answer 3

Your question assumes that there is such a thing as a Good security question. I'd argue that there isn't such a thing. This has always been true but today's connected world and social networks make it readily apparent.

A good security question would require an answer that is not easily known or discoverable, not subjective, static, have a clear single answer and applicable. The reasons for those requirements should be fairly obvious but a security question is no good if it isn't a secret or depends on your mood that day or changes over time, has multiple possible answers or just doesn't apply to someone.

This eliminates pretty much anything about your family (mothers maiden name, birthdays etc) as this is readily discoverable even if you don't post it yourself on social networks. It also eliminates your favorite XYZ as favorites are subjective and change over time. You can also eliminate the color of your first car as that may be readily available information, not apply to many people or even not have a clear single answer. Is the car grey or Arctic silver or metallic silver grey? Pretty much everything you can come up with will fail one or more of these tests even if you are trying to come up for questions yourself.

Even if you do let people pick their own questions and they do come up with reasonable good ones odds are they would just start reusing them across multiple sites and the first breach that came around would have them in clear text in the database and they'd no longer be good security questions.

Answer 4

The questions may be generic, but the answers need not be. If you use a password manager application, and you strictly adhere to a robust password management process, then you could use randomly generated answers.

For a question like "what was the make of your first car?" instead of putting "Ford", you would put something like "hIUYkjh7657".

No amount of social media trawling will get a would-be hacker anywhere near the answer.