237
votes
Accepted
Why is Mother’s Maiden Name still used as a security question?
Because people are lazy and/or incompetent. And, well, you know, the Internet is full of chimpanzees.
I would argue that all security questions are bad, but using the mother's maiden name is ...
- 65.8k
28
votes
Why is Mother’s Maiden Name still used as a security question?
"Security questions" may be the only solution to a hard problem. You've got a customer, they've lost their password (and their email access) and you'd both like to get them back.
It may not be ...
- 817
26
votes
Why is Mother’s Maiden Name still used as a security question?
Lethargy and/or inertia
More seriously institutions relied on this information being essentially secret for a few decades. The age of mass publicised data breaches is very recent.
Most organisations ...
- 1,117
24
votes
Why is Mother’s Maiden Name still used as a security question?
False assumptions.
Security questions, just like "complex" password requirements, are rooted in what is called best practice but actually isn't. Like an oral tradition, many of these practices are ...
- 10.7k
12
votes
Accepted
Do security questions make sense?
The inherent contradiction of security questions
For a security question ot be good, it must:
Have one definitive unambigious answer that the user would never forget...
...but is secret and hard to ...
- 65.8k
11
votes
Why is Mother’s Maiden Name still used as a security question?
Usability over security, sadly
The banks want to be secure, but face a clientele for which usability is mandatory.
This clientele is not made of our peers. It includes those who fear "the gub'...
8
votes
Do security questions make sense?
Security questions are a terrible idea.
There are no "best practices" like there are for passwords: a password should be hard to guess, long enough, etc. Are security questions any of that? By design,...
- 33.1k
6
votes
Does removing my security questions on Yahoo make me more secure?
Disclosure: I work for AgileBits, the makers of 1Password, a password manager.
Security questions are terrible. In fact, pretty much everyone who studies these calls the insecurity questions.
First ...
- 6,655
5
votes
Do security questions pose threat to the user?
You should absolutely lie!
Security questions are only looking for a match, answers needn't even be in context to the question (usually). Not only should you lie you should lie differently everywhere.
...
- 8,213
4
votes
Is this "forgotten-password" procedure safe/legal?
First, questions about legality should be directed to https://law.stackexchange.com. As for the rest let's break it down to secret question security and id security:
Secret Questions
Using secret ...
- 31.7k
4
votes
Are security questions considered as 2FA?
There are main 3 factors
Something You know - Password, Question, PIN..etc (Type 1)
Something you have - Token, Smart card...etc (Type 2)
Something you are - Iris scan, Fingerprint...etc (Type 3)
...
- 655
3
votes
Accepted
Do security questions pose threat to the user?
Regarding threats, of course they do. If you use the actual answer to the question, an adversary posing as you can learn one of the two:
The information that was protected by the password that was ...
- 346
3
votes
Why is Mother’s Maiden Name still used as a security question?
The answer is same as: why do we have simple locks in real life, which is so easy to pick-lock or break.
It's always good to let user select his security level.
I bet password to launch nuclear ...
- 59
3
votes
Why is Mother’s Maiden Name still used as a security question?
"Security questions" in general are an incredibly stupid idea.
Any time you create a password, it's routine advice to say that you should not use personal information for a password, like where you ...
- 869
3
votes
Do security questions make sense?
As you can see from other answers on the same topic (searching for "security question" here returns several related questions), traditional security questions like "What's your mother's maiden name?" ...
- 15.9k
3
votes
What is the purpose of forcing people to provide "security questions" and answers to them?
You are essentially correct, they don't really "increase security." They are there to (nominally) increase user convenience in case a password reset is needed, at a cost to over-all security.
If you ...
- 1,962
3
votes
Does removing my security questions on Yahoo make me more secure?
From what I remember, all of the questions that were stored in clear-text were being flagged for removal. This all ties back to the info they just released. So in this case(and actually most cases), ...
2
votes
Why is Mother’s Maiden Name still used as a security question?
The purpose of security question is long-term validity. You need to remember it when you forgot/lost the password. That's why an inherent piece of information you cannot easily loose fits well. This ...
- 703
2
votes
How many security questions should be asked?
If you check OWASP, there are some resources to try and help.
But their basic point (which I have heard made several times in other places, but cannot find link for) is that security questions are ...
- 3,661
2
votes
Do security questions make sense?
It's better than no second-factor, but current 2FA standards recommend
something you know
something you have
A lot of banks use security questions or image-recognition because it's thought to ...
- 731
2
votes
Do security questions pose threat to the user?
I'd say that it depends on how the security answer is stored. Reading this Microsoft answer it appears that within Active Directory at least, security questions are stored as hashes in much the same ...
- 71
2
votes
Accepted
Is it secure to make user able to disable 2FA with 2 security questions if they have lost backup codes?
I wouldn't say using security questions for pretty much anything is "secure".
There have been so many compromises of personal information, ranging from financial (Equifax) to social (Facebook) it's ...
- 5,160
2
votes
Accepted
User-provided phrase to verify email sender- Is this a good idea?
This is an extension of the advice on how to verify emails from authorized senders. Usually, you want to see some sort of info in the email content that is not generic or public knowledge. This ...
- 132k
1
vote
User-provided phrase to verify email sender- Is this a good idea?
Seems to be a poor man's digital signature replacement. The medical service probably doesn't trust its users (ie. their ability to handle proper digital signatures) therefore a simplified version was ...
- 643
1
vote
Are security questions considered as 2FA?
Security questions, such as "what is the name of your first pet?" are not 2FA because they substitute to your password.
In 2FA, you need to input the two factors to authenticate (log in). ...
- 10.7k
1
vote
How are "security questions" not a major security hole for any application that uses them?
Email password reset is not particularly secure either, since it means that if you manage to compromise someone’s email account you can take over all of their other online accounts. At least with well-...
- 10.3k
1
vote
Do security questions make sense?
In a surprising number of applications a password + security question is considered 2 factor authentication. The idea is that its something you know whereas a password is expected to be something you ...
- 18.8k
Only top scored, non community-wiki answers of a minimum length are eligible