7

Attempting to understand the key factors in evaluating the fitness of security questions.

By security questions, I mean for example:

3
  • 6
    I don't even read these questions, I choose the first option and enter a long random string of characters. This is then saved to my password store and instantly forgotten. The idea that people answer these questions honestly is scary, but then so is people's idea of a strong password (generally speaking). – James Oct 1 '14 at 10:04
  • Security questions and answers might be hashed in a database, so it might not be too unreasonable to ask that. – InvalidBrainException Oct 1 '14 at 15:50
  • 2
    @InvalidBrainException: might be is the key part of the phrase. Given the number of sites that apparently don't even do this for passwords I'd lean towards this being unlikely. – NotMe Oct 1 '14 at 15:51
15

Security questions are an example of security theatre. You can consider them a very weak form of password at best, and they are often readily guessable.

If you are going to use them, make sure they are ones that have the following characteristics:

  • they have many possible answers (city names are terrible for this, especially in countries that have relatively few large cities like Australia)

  • the answer does not change over time (so favourite anythings are out)

  • is not easily obtained via social media or other online information

You also need to consider your user base. It is amazing how many things you forget as you get older.

1
  • I don't think you understand the mitigation. Security questions do not serve the same purpose as a password, they are typically part of a MFA anti-phishing scheme, as required by U.S. law since 2006. – John Wu Oct 1 '14 at 17:24
6

Back in 2007 I wrote a whitepaper on how to evaluate security questions which you are welcome to read in full but I'll summarize my thoughts here.

I applied five characteristics to evaluate security questions as authenticators, those being

  • Usability
  • Uniqueness
  • Integrity
  • Accuracy
  • Affordability

Affordability is pretty consistent across all security questions, so I'll focus on the other four.

Usability

What percent of your users can truthfully answer the security question? If I have never had a pet I can't provide a truthful answer to 'What was your first pet's name?' There may be regional or cultural differences that make certain questions difficult to answer. For instance the question 'what state did you grow up in' doesn't apply to people whose countries don't have states. Privacy may also be a concern, depending on what the question is asking.

Memorability plays a role in usability, which I'll discuss further in the Accuracy section.

Uniqueness

How different are the possible and likely answers users will give to the security question? If an answer isn’t unique enough then it provides unreliable authentication of the user’s identity. Asking 'what color are your eyes?' has a very limited number of possible answers. Asking 'what is your favorite color?' has more possible answers but has very predictable likely answers.

The better distributed the likely answers are in a sufficiently large pool of possibilities, the better the question tends to be. This is a difficult challenge to overcome for security questions since truthful answers to many questions will stand out as statistically more likely answers.

Integrity

How difficult is it for users to avoid disclosing valid answers to a security question? Some answers to questions are not considered secrets and may be known to family, friends, coworkers, or even strangers with access to social networks.

This will also rely, in part, on the user’s commitment to keeping the security question answers a secret. A user will have to not only attempt to keep from providing answers to this question in the future, but will have to think about whether they've provided answers in the past that could be looked up. If they've disclosed an answer then the associated security question really shouldn't be considered appropriate to ever use again.

Integrity is also a very complicated challenge for security questions since they are, by design, based on non-secret information. Consider the difficulty of a user not disclosing the answer to a specific security question through normal behavior.

Accuracy

How frequently will the user successfully recall the security question answer and enter it correctly? This is related to usability. Ideally you want an answer that isn't going to change over time and one that is unlikely to be forgotten. Questions can usually be broken into the categories of facts and opinions. Facts are "what was your first pet's name" versus an opinion like "what is your favorite animal". As you might suspect facts seem to be a bit easier for people to remember than opinions.

Many security question systems ignore things like the case sensitivity or punctuation of answers, and may even allow character to be added or left off. If you set minimum answer lengths you may also force users to modify legitimately short answers into something that they may not recall later.

Conclusion

These factors can help you compare different security questions, but as others have pointed out there don't tend to be any really 'great' security questions because of their inherent limitations. I only recommend their use when you can eliminate the poorest questions and prompt users for valid answers to at least three at a time.

I actually was able to analyze real user security questions and answers last year and shared my findings in a few talks. The data supports a lot of our suspicions about uniqueness problems, and further discourages reliance on them for strong authentication.

0

Most security questions ask for the sort of information that can be found in a few minutes on a social networking site, and so provide no security whatsoever. A good question is one where the authorized user is the only person who knows the answer.

Of those on your list, only "what is your preferred internet password" has any security value.

4
  • 2
    You're kidding that the only one of any value is, "what is your preferred internet password?"... right? If not, given pretty much anyone, including Schneier agrees it's poor form, I'd request you expand on why you believe it's of value. – blunders Oct 1 '14 at 1:15
  • 4
    It's not something that you're going to post on Facebook, and it implies that you should keep it secret. – Mark Oct 1 '14 at 1:21
  • 2
    Putting aside the potential for implementation related vulnerabilities, secrets should not be shared and answering that question is sharing a secret. – blunders Oct 1 '14 at 1:26
  • 2
    @blunders I suspect the last statement was sarcastic, since nobody should have a "preferred internet password". – l0b0 Oct 1 '14 at 11:29
0

Some systems allow you to create your own question. I have had a 29-digit number memorized for over 30 years. I know where it is written (in a formerly popular book) and can therefore find it if I should become confused, but no one else knows which particular long number I have in mind. So let's hear it for "What is the answer to your favorite unique question that is not written down"?

I still think that "Something Nobody Knows (including me)" is the most secure piece of info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.