Countermeasures for a family-member attack on a password reset procedure

Question

Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker needs both information and access to use the password reset mechanism for an account takeover.

These controls are often very useful against some random attacker on the Internet, but I want to focus on when a family member is the attacker (e.g., parent trying to get onto child's account, boyfriend/girlfriend trying to get access to partner's account, etc.). In this scenario, the person is very likely to know the answer to any personal challenge questions (mother's maiden name, first car, third grade teacher) and is also likely to have physical access to the victim's phone or PC. Let's also assume that the victim is not a security minded person, so they leave their email open in a tab and does not have a screensaver password and their phone is protected by a pin which is their birthday.

As a security guy, I always put in gibberish for answers to security questions and store the answers with encryption, but since the victim doesn't really want to deal with a password manager, doesn't know what encryption is, etc. we cannot rely on the user taking countermeasures to protect him/herself since the victim may legitimately need to use these answers to recover his/her account.

Knowing that there is the physical security issue and that information is not well known, what countermeasures or controls can the service provider implement to help protect the user from an attacker who is a family member/friend with physical access.

Answers should be on the service provider side, since the goal is to protect an unsophisticated end user.

Answer 1

The two main methods that I have considered for this are:

1. User Defined Questions

Most of the default questions I see on sites seem to be the same or very similar, easily researchable through social media, etc. I would generally think that allowing users to write their own security questions would be better with some guidance. e.g., "Come up with two questions, make them things that no one else would know, not even your mother". User's could still end up coming up with bad questions, but at least some percentage of users will be crafty and it provides an overall improvement across the population of users

2. Private Site Action Verification

While a lot of activity on a social media website may be public, even on such sites there is often some activity a user does which is private or known only to the user. There is no reason for the user to share this information with anyone and it is site specific. For example, on a banking website you could ask them to verify the amount paid on a utility bill. Even giving them the choice of three values and a "none of the above" provides some degree of protection. Of course, in that particular case, the bill may come in the mail or may be a shared expense. A potentially better question may be "Who was the last person you sent a private message to?" since this is by definition not public, but may be guessable by a family member who knows who your best friends are.