1

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the security questions but masks the answers (I put dummy masked answer on the review page). Now they are given the chance to edit their information before creating an account.

So, if the user decides to go back and edit the security questions and answers, I am wondering should I display the answers back from the server to client in plaintext(The client wants the answers to be typed in as plaintext) or should I just blank out all the answers field (but keep the questions selection) and have the user type in all the answers again to proceed?

What is the better approach from a security standpoint?

Currently, I would be hashing and adding a salt to the security answers to be saved as such in the database.

1

Assuming this is all done during the enroll process, which it sounds like it is, there isn't a lot of risk associated with displaying the plaintext answers to the user. It's pretty unlikely that an attacker will be able to hijack a user's session mid-enrollment in order to see the security question answers.

However, it doesn't seem like it would be terribly inconvenient for the user if you blank out those answers. I suppose a small percentage of people might go back to edit them in order to make sure they recorded the answer they thought they did moments ago, but they could also just retype the answer they wanted. So if it makes you feel better to blank them out there probably won't be a lot of user frustration associated with that practice.

If a user can log into the app at a later time and edit security question answers then my advice would be to not display the current answers since it is more likely that an attacker could hijack a normal session (or find a logged in browser) and copy the answers.

It sounds like your plan to hash the answers would make that functionality impossible in your app anyway. That practice, by the way, is likely to cause you some usability problems since people may not type in their security answer exactly the same way during enrollment and later during use. Some implementations of security questions encrypt answers instead so they can make looser comparisons (e.g. not case sensitive, ignore trailing spaces, etc.) and be more user friendly. That is a bit less secure, but it is a tradeoff some people are willing to make.

  • Can't you canonicalize the answers before hashing to allow things like case insensitivity and trimming of spaces? – Neil Smithline Jun 19 '15 at 17:46
  • @NeilSmithline Sure. But I've also seen solutions that accept minor spelling differences. They're evaluating the strings by scoring their similarity rather than exact matching. That's harder to do when hashing the answer. – PwdRsch Jun 19 '15 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.