0

For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating.

When would we be the right time to ask the user select the questions and set the answers?

1- at the time a new user creates a new account with the web application (enter username, password, and answer security questions)?

2- or at the time of first log in (after confirming the e-mail is valid)?

Is there any security and user experience factors to lean to one of these options?

Improve this question
4
  • Things that some my mind is: - if the user answer the security questions at the time of creating the account and there is a key logger on their machine, both the password and security questions are stolen. If we separate the steps, there might be chance that security questions are set on a different machine.
    – Goli E
    Jan 29, 2015 at 18:20
  • 3
    Not what you're asking, but it should be noted that these so-called "security questions" are only good for harming the security of the system, for several reasons. Known, fixed answers; discoverability; very low entropy (even if you dont know the answer); shared secrets with any other site that asks for them; increased risk of identity theft; etc etc. So, for "enhanced security", forgo drilling an airliner-sized hole in your app's protection, and build a better solution for password reset. (And a strong authentication mechanism too).
    – AviD ♦
    Jan 29, 2015 at 20:00
  • When should you use security questions? never.
    – Sam I am says Reinstate Monica
    Mar 18, 2015 at 22:20
  • @AviD Low entropy is not an issue if you only allow the security question to be answered once in a couple of hours per user. Shared secret, how about calculating hash(user + answer) client-side? Besides, when combined with a browser check and only enable the functionality if there hasn't been a recent succesful login, this is pretty secure. Of course it also depends on the quality of the security question. The note should be that implementing this is tricky, you should be really careful, because a lot of things can go wrong. But it is definitely not harmful in principle.
    – Yeti
    Jul 26, 2018 at 9:14

3 Answers 3

Reset to default
1

No right answer.

I hate security questions though. Never remember them. Usually fill them with random stuff. If I do need to recover the site, I'll call the company or file a support ticket anyways.

You didn't give enough information to really understand the situation, so here are some options.

Option 1
 1. creates account
 2. confirms email
 3. answers sec questions
 4. Uses site

Option 2
 1. creates account
 2. answers sec questions
 3. confirms email
 4. uses site

Option 1 and 2 are the same. Both questions and confirmation are required before the user can do anything.

Option 3
 1. creates account
 2. Uses site
 3. Tries to do something (save data, print, email, etc)
 4. Forced to confirm email
 5. Forced to answers security questions

I like option 3 if your site supports it. The user can use the site, but you block them from any real functionality until they confirm their email. It gives the user a chance to evaluate the site before committing extra time.

Option 4
1. Creates account
2. Confirms email
3. Uses site
4. Next Login, asked security questions

Option 4 is how gmail approaches extra security features. The present the user with an option to enter phone numbers, and other recovery items. Of course, they don't do security questions. They use phones. Which is a lot less burden on the user.

Improve this answer
0

"For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating."

So you are still relying on one-factor authentication, something the user knows and are thereby gaining little in terms of security. What you want to do is implement something where the user gets a text message or some type of token sent to a device that they control.

However, to answer the question you posed from a pure UX experience don't ever ask them to supply a set of security questions unless the user explicitly requests to have their account be recoverable. This can be handled by allowing a user to edit their profile and mark a check box that says "I would like to recover my account". This process would then spawn a modal that has them generate security questions in the event they lose their password.

Improve this answer
5
  • 1
    you really did not answer my question. Imagine we conclude that we need to have security questions. Now, is there any reason to ask them at the first login time or at account creation.
    – Goli E
    Jan 29, 2015 at 18:12
  • That's the best solution from a computer security standpoint, but practically it will cause lots of wasted customer support manhours spent manually unlocking accounts for users who don't care about security and just want to get into their account after forgetting their password.
    – Aron Foster
    Jan 29, 2015 at 18:18
  • 1
    @AronFoster the good news is this is a security focused website.
    – Woot4Moo
    Jan 30, 2015 at 0:59
  • @GoliE I still answered your question. I proposed a third option that was neither of what you proposed. If you want the community to answer a question of A or B this question is a poll and should be flagged as such
    – Woot4Moo
    Jan 30, 2015 at 1:00
  • @Woot4Moo Being on a security focused website is a reason to disregard the reality in which we work?
    – Aron Foster
    Jan 30, 2015 at 2:32
0

You tend to want to add another layer of challenge when conditions of login change:

  • recovering the password (as you mentioned)
  • first login (as you mentioned)
  • log in from a new location
  • after X failed login attempts
  • etc.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.