232

Because people are lazy and/or incompetent. And, well, you know, the Internet is full of chimpanzees. I would argue that all security questions are bad, but using the mother's maiden name is exceptionally bad: At least in Sweden, I can find out anyone's maiden name just with a simple call to the tax office. It is literally public information. It's 2018, ...


56

This is an absolute breach of security. Even if their policy was somehow sound, sending the password in plaintext to you in an email means that the reset is useless, and as you said, if the attacker had access to your email the security questions wouldn't do squat. They should have done nothing as the security question answered was invalid. The best thing ...


28

"Security questions" may be the only solution to a hard problem. You've got a customer, they've lost their password (and their email access) and you'd both like to get them back. It may not be proportionate to have them perform in person verification at your offices or with a notary, which would really be the only totally secure solution (matching secure ...


26

Lethargy and/or inertia More seriously institutions relied on this information being essentially secret for a few decades. The age of mass publicised data breaches is very recent. Most organisations are slow to react to change. Simple as


24

False assumptions. Security questions, just like "complex" password requirements, are rooted in what is called best practice but actually isn't. Like an oral tradition, many of these practices are passed on from one security person to the next, and rarely questioned (whenever they are questioned, it often turns out they are bogus). Security questions is ...


18

No, it is not an appropriate response from the ISP. The attacker tried to reset the password, which shows that the attacker does not know the current password, and actually does not even try to guess it. Forcing a reset of that password cannot bring any good: it tries to fix exactly the part of the authentication system which was not broken. If resetting ...


12

Basically, people are rubbish at coming up with questions. They come up with things like "Type 'secret'" or "My name" - they're worthless at best, and actively harmful at worst ("Usual password" - the answer to the question will tend to be stored in plain text...). Even pre-determined questions are fairly bad - they tend to either be easily guessed, or ...


11

Usability over security, sadly The banks want to be secure, but face a clientele for which usability is mandatory. This clientele is not made of our peers. It includes those who fear "the gub'mint", seniors who don't understand change and resist it, mentally disabled who took years to learn this system and just can't process another scheme, not to ...


11

A 2015 study based on Google's deployment of personal knowledge questions contains a lot of evidence for the many problems with them: Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google Some findings: secret questions generally offer a security level that is far lower than user-chosen passwords a significant ...


10

Specifically with regards to security questions you are asking users to share potentially sensitive facts about themselves that are likely obtainable by social engineering of people near them. That makes security questions at best inadvisable and at worst downright dangerous from a holisic security perspective. OWASP, while good overall for explaining the ...


7

Disclosure: I work for AgileBits, the makers of 1Password, a password manager. Security questions are terrible. In fact, pretty much everyone who studies these calls the insecurity questions. First of all security questions are another way into your account. But let's compare their security properties with passwords. Security answers are not secret My ...


7

You make a comment that predetermined security questions are more likely to be guessed by attackers than user-defined questions. That assumes your average user will design a better (e.g. more secret, less guessable) question than the people implementing the system. This doesn't seem to be true for most users. In one lab study subjects only spent an ...


6

The inherent contradiction of security questions For a security question ot be good, it must: Have one definitive unambigious answer that the user would never forget... ...but is secret and hard to guess for everybody else. The problem is that the higher you score on #1, the lower you score on #2. So you have to walk a tight rope here. If you lean to far ...


5

You should absolutely lie! Security questions are only looking for a match, answers needn't even be in context to the question (usually). Not only should you lie you should lie differently everywhere. Favorite Food: A Red Bicycle Of course this puts the onus on you to keep track of your lies. Two Factor Authentication (2FA) should be used if possible/...


4

The scenario that this is designed to prevent is keylogging. It is fairly easy to get a keylogger that will report back but somewhat more complex to make a program that will actually execute an attack remotely on another computer. Since you don't regularly enter your security question answers, if an attacker obtains your password via a key logger, they won'...


4

The only case I can think of where changing your password like that would make security sense is if the user was logged in to your account when they tried to change your password. In that case, your previous password was potentially compromised, because whoever was logged in knew that password but not the answer to your security question.


4

First, questions about legality should be directed to https://law.stackexchange.com. As for the rest let's break it down to secret question security and id security: Secret Questions Using secret questions at all for account recovery has basically been a "deprecated" security step for quite a while. My go to example of why this is a bad idea is the ...


3

From what I remember, all of the questions that were stored in clear-text were being flagged for removal. This all ties back to the info they just released. So in this case(and actually most cases), yes you ARE safer removing them.


3

"Security questions" in general are an incredibly stupid idea. Any time you create a password, it's routine advice to say that you should not use personal information for a password, like where you went to high school or your favorite color or the make car you drive, because a hacker trying to break into your account might be able to discover or guess these ...


3

In all generality, no, you cannot use such a scheme with a storage based on hashing and still expect the same kind of security as with full-password hashing as it is normally practised. Here is the demonstration: the point of storing the hashed password, and not the plaintext password, is that you just assume that attackers may obtain a (possibly read-only) ...


3

The answer is same as: why do we have simple locks in real life, which is so easy to pick-lock or break. It's always good to let user select his security level. I bet password to launch nuclear bombs could not be recovered by mother's maiden name. But typical user has 2-3, maybe 10 really important accounts. And hundreds of other accounts. E.g. account in ...


2

This is not good practice. I would be a bit suspicious that the SIP provider had in fact been compromised, but wanted to save face or reduce the potentail for neative publicity by being possibly less than clear/honest or a little ambigious. Basically, changing your password after a FAILED attempt makes absolutely no sense. Sending you a new password via ...


2

Fraud management. The bank's website may be using Geo-location and device fingerprinting.from Wikipedia Geo-location is the identification of the real-world geographic location of an object, such as a mobile phone or an Internet-connected computer terminal. Device fingerprinting is information collected about a remote computing device for the ...


2

Usual process There are two common ways to implement the so-called "security question" (which I don't think to be very secure anyway, but that's another subject): Propose the user to choose a question from a set of already defined questions, Propose the user to type his own question. The issue with the first possibility is that you will have a very large ...


2

Could you not hide/wipe-out all secret information (personal, billing, payment) when the user resets the password? It probably won't take them very long to re-enter these. You can also restore all these when they manage to re-enter one valid payment info matching the previous ones. Never trust any information that can be socially engineered (birthday, ...


2

This will depend somewhat on how much security you need. You mention you are an e-commerce site; do you store customer credit cards for "one click" style ordering? If not, I expect the impact of account breach is relatively minor, so you can probably get away with a relaxed password reset process. For example, simply sending a reset link to the stored email ...


2

The purpose of security question is long-term validity. You need to remember it when you forgot/lost the password. That's why an inherent piece of information you cannot easily loose fits well. This means the first assumption of the question does not fit. As for the second part that it could get or already be public knowledge: a) Such security questions are ...


2

I agree with your security team. The "security question" is not secure on its own: cities can be found over ip, names can be googled and nicknames of pets can be guessed. However, you could combine both methods: first send the mail, and when the user clicks the link, ask the question. This way you would add at least a bit more security to the procedere. ...


2

If you check OWASP, there are some resources to try and help. But their basic point (which I have heard made several times in other places, but cannot find link for) is that security questions are generally not a great approach. However, they do say a good practice might be to require the user to select 1 or 2 questions from a set of canned questions ...


Only top voted, non community-wiki answers of a minimum length are eligible