Contents
Are security questions actually secure?
Security questions are vulnerable to exploitation because they rely on knowledge—if an attacker guesses, researches, or phishes a security answer, for instance, the account is compromised. Not even the best security questions are immune to these attacks.
How does a security question work?
How security questions work. The idea is simple: when you create an account, you provide the answer to a question of a personal nature; ideally, a question only you know the answer to. That answer is recorded, and should you ever need to confirm that you are the legitimate account holder, they ask you that question.
Why are security questions used?
A security question is form of shared secret used as an authenticator. It is commonly used by banks, cable companies and wireless providers as an extra security layer.
What makes a good security question?
According to the Good Security Questions website, answers to a good security question should meet these criteria: Safe: Cannot be guessed or researched. Stable: Does not change over time. Memorable: Can be remembered.
What are common security questions?
Here are examples of some common security questions:
- In what city were you born?
- What is the name of your favorite pet?
- What is your mother’s maiden name?
- What high school did you attend?
- What is the name of your first school?
- What was the make of your first car?
- What was your favorite food as a child?
Which is the best way to ask security questions?
Many good security questions are not applicable to all users, so the best approach is to give the user a list of security questions that they can choose from. This allows you to have more specific questions (with more secure answers), while still providing every user with questions that they can answer.
Which is an example of a user defined security question?
With user defined security questions, the user must choose a question from a list, and provide an answer to the question. Common examples are “What is your favourite colour?” or “What was your first car?”
Can a user write their own security question?
Allowing users to write their own security questions can result in them choosing very strong and unique questions that would be very hard for an attacker to guess. However, there is also a significant risk that users will choose weak questions.
How are security questions used in an authentication flow?
Security questions may be used as part of the main authentication flow to supplement passwords where MFA is not available. A typical authentication flow would be: The user enters their username and password. If the username and password are correct, the user is presented with the security question (s).