5

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own password (I assume it is unique for each hash).

He claims this is a great way to always know the answer to your security questions without actually being truthful (some of those questions could be / used to be rather revealing) or knowing ahead of time which order they will be asked.


For Example:

Q: What is your mother's maiden name?

A: dc6bae2bdc569b1ef118bf6a497c65a0e70fadaa653bfadabffe5519708fb538password

  • where 'password' is actually a random and secure one (presumably stored in a password vault and specific to each question hash).

Instead of:

Q: What is your mother's maiden name?

A: mommy


Is this method really secure or just a waste of time?

My question to him (and you guys) was why bother with the hash? Why not just keep a secure list of questions/passwords?

8

I generally dislike security questions in general; they usually ask for information that is more or less public. Mother's maiden name? Ancestry.com will tell you that. Your high school? Facebook, LinkedIn, any of a number of social media sites that use the info to suggest potential friends will not only have it, they'll advertise it if you aren't careful with your profile settings.

In this case, your source agrees, and instead of providing the actual answer, is simply making this scheme an alternate password. If the passwords he is using are random, strong and unique, that should be all that's necessary. If he's using a common password, the question hash is security through obscurity; once the fact a hash is used, and the method to generate it, are known to an attacker, it's broken.

Either way, it's not a total waste of time, but the simple fact that the way you do something is a secret outside the digital world cannot be relied upon for security within it. In this guy's case, it's not a secret that he uses this method, so he can no longer count on it to protect him and is a waste of time in his own case. The practice of using an alternate password as the answer to a security question (unrelated to the actual real-world answer to the question) is relatively secure on its own, as long as both the user and the website take the same care to protect the confidentiality of the security answers as the password itself.

  • 1
    do you have any information on how most sites handle the confidentiality of the answers? Because my guess would be that they would not hash it, so that an approximate answer could be used as well (like on the phone: I went to albany high, Do you mean Albany High School?). – tim Aug 30 '14 at 11:00
  • 2
    In Microsoft's "Membership Provider" framework, used for ASP.NET sites, it is hashed using the same salt as the password, but that's an implementation detail; the framework does not allow you to retrieve the answer and perform any custom comparison. The answer is submitted to the underlying provider, and you get back a result saying whether it matched. How a match is determined is left to the actual provider; a system could be implemented that can perform an approximate match (case-insensitive, spell-checked, heuristic), but there would have to be an alternate way to secure the answers. – KeithS Sep 2 '14 at 17:17
  • Another problem with security questions is that in many cases the answers may be even less memorable than passwords, since they relate to things that happened long ago and had been essentially forgotten. "First girlfriend?" Did I answer that with a girl I palled around with in second grade, the woman I was attracted to in high school but never did anything romantically, or the first person with whom I had a serious long-term steady relationship, or what? – supercat Sep 28 '14 at 20:18
5

I agree with the other answers that the "security questions" really don't do much good. The theory behind them is that only you will know the answers to those questions, and they will be used to let you back in to your account should you have forgotten your password. Unfortunately, the answers to most security questions can be found online if the attacker knows where to find them(e.g. Facebook, LinkedIn, etc.), or if they are really determined, can be social engineered from you or people you know.

Additionally, I have found that the answers to security questions are probably not stored in a "secure" way, in that when you call for account support, the rep may ask you to verify yourself by providing answers to your questions. They would not know the answer unless it is available to them in plaintext. Therefore I would not consider them to be secure answers.

Given that, I would say that your friend's method of remembering his answers does more harm than good, as it is in fact storing the password either in plaintext, or in a reversible encrypted format, neither of which is good for security. Additionally, anyone can make a hash of the question, as long as they know which hashing algorithm was used, so that does not really add to the security of the system.

If a site requires that I submit answers to security questions, I generally provide nonsense answers that can't be related to the question.

Q: What city did you meet your spouse in?
A: Bananas

I then record all of my question/answer pairs in my password manager, so I can give the correct answer when challenged. I do this instead of using random strings, because of the aforementioned need to converse with support reps occasionally (like at a bank asking you to verify your identity). I find this the best way to both comply with their need for security questions, but also keep my account secure.

1

Security question is actually a misnomer as it doesn't really improve security of an account but is more like having a back door to the house. You don't have a key (password) to the front door, no problem, enter from the back if you know the number to open the combination lock.

That said, the method you proposed is akin to requiring the same key for the back door as well. There is a problem as you might be exposing your password which is not hashed, but directly appended to the end of the security answer. A cracker who somehow manages to get access to the database can obtain your password in clear text.

Further, doing something like that is quite redundant as once you have forgotten your password, you effectively loses your second access to the account through answering the security question. If you do not want a back door to your account, simply type a random string and don't bother saving or remembering it:

Q: What is your mother's maiden name?

A: dsfjot4-5bl;f;js gge[rti[5iyj[hglk,l;dfqkportgijrb1

Email authentication would be a much better option to reset a lost password for an account that is registered using an email address.

  • 2
    I would definitely save it. Some sites not only use these questions for password recovery, but also in random intervals or on special actions as "additional security". So you will have a problem if you didn't write it down. – tim Aug 30 '14 at 11:03
  • Agreed; some sites use this as a cheapo alternative to 2-factor authentication, so you never know when you'll need to know the answer. – octern Aug 12 '15 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.