Skip to main content
1 of 7
Luc
  • 33.1k
  • 8
  • 81
  • 140

The answer is yes, you should always hash this.

Why do we hash passwords at all? Basically because people may use the same password for multiple services, and to prevent people from logging in with read-only database access.

So don't you think the user's first pet or mother's maiden name is also data that he would use across multiple services? Or that could potentially be used for social engineering attacks? Or could be used to reset the password and also gain access?

For that reason, you should protect answers to security questions against attackers (and admins!) the same way as you do with passwords.

Luc
  • 33.1k
  • 8
  • 81
  • 140