Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Personal questions, such as mothers maiden name, used for authentication. Commonly seen during account recovery. Also known as "security questions".

3
votes
1answer
138 views

Is this “forgotten-password” procedure safe/legal?

Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
0
votes
4answers
129 views

Do security questions make sense?

Is it a good practice, or is it obsolete? I'm asking because I've never managed to remember a single security question, thus I always write down the answers. I think they are useless, long passwords ...
160
votes
8answers
33k views

Why is Mother’s Maiden Name still used as a security question?

From time to time, some web sites asks to enter a security question and an answer for it. The question list is standard and it usually includes "What is your mother's maiden name?". Some people use ...
8
votes
2answers
104 views

What is the purpose of forcing people to provide “security questions” and answers to them?

Am reinstalling Windows 10. Dang. It forces me to provide no less than THREE security questions. I have to choose them among questions like, What was the name of your first pet and What city were you ...
0
votes
3answers
232 views

Does removing my security questions on Yahoo make me more secure?

My Yahoo account was hacked and I am very worried about why. They said I was more secure after removing my additional security questions. Is that correct?
3
votes
3answers
1k views

Which is more secure for a reset password feature - security questions or reset link in email? [duplicate]

I need to provide the Reset Password Feature for my product. For this I have two competing solutions: Send the password reset link in mail to the user Provide the Security Question based solution ...
4
votes
3answers
2k views

Should I let users pick their own secret questions for password reset?

I'm building a web application and I'm actually writing a code that allows users to choose their secret question and answer used to identify them if they forget their passwords. I'm a little bit ...
4
votes
1answer
279 views

Is a security question you just have to 'remember' a good idea?

I was setting my eBay security questions and one of the choices were: Now I've seen sites that allow you to "type your own question" and "type your own answer" but unless they forgot a text field, ...
10
votes
1answer
674 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
1
vote
1answer
105 views

Using the index of characters in a security question [duplicate]

I'm seeing many sites offering one or two "security questions" that have to be answered by choosing characters at specific indexes, in addition to username + password. For example: "What is your ...
2
votes
5answers
429 views

What if user can't answer the security question during password reset?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
36
votes
4answers
3k views

Why did my provider reset my password after someone else attempted to gain access to my account?

Recently a provider (of SIP trunking services) I subscribe to sent me a strange email. It claimed that someone in another country attempted to reset the password to my account and was unsuccessful in ...
8
votes
3answers
498 views

Does prompting for security questions on new computers add any security on banking websites?

When you sign into Bank of America on a computer you haven't used with them before, the site prompts you to answer one of your security questions. How exactly does this make the site more secure? ...
15
votes
6answers
3k views

Is storing answers to security questions in plain text bad form?

If the input for the security question is completely digital, should the answer to a security question be hashed (or at least encrypted) on the authentication server?
1
vote
1answer
905 views

How do security questions work? [duplicate]

Possible Duplicate: Do security questions subvert passwords? Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he could ...
15
votes
3answers
6k views

Should security question answers be case-sensitive?

Question In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers? Scenario An ...
52
votes
7answers
4k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...