Contents
How are security questions stored?
Storing Answers The answers to security questions may contain personal information about the user, and may also be re-used by the user between different applications. As such, they should be treated in the same way as passwords, and stored using a secure hashing algorithm such as Bcrypt.
Should security questions be hashed?
Don’t do security questions. They’re super bad for a lot of reasons. But if you do use them, then at least protect your users a little bit and hash the answers. As mentioned by @Polynomial and @B-Con, storing the security questions unencrypted is dangerous if those can effectively be used as password.
Is it safe to store answers to security questions?
This provides a reasonable security measure without reducing usability. If those questions provide the same level of access as the password, then for all practical purposes they are a password and should be treated like one. Apply the same level of protection to all passwords that you store. The answer is yes, you should always hash this.
What are the characteristics of a security question?
Any security questions presented to users to reset forgotten passwords must meet the following characteristics: The user must be able to recall the answer to the question, potentially years after creating their account. The answer to the question must not change over time.
Can a user write their own security question?
Allowing users to write their own security questions can result in them choosing very strong and unique questions that would be very hard for an attacker to guess. However, there is also a significant risk that users will choose weak questions.
Do you treat security questions the same as passwords?
If those questions provide the same level of access as the password, then for all practical purposes they are a password and should be treated like one. Apply the same level of protection to all passwords that you store. The answer is yes, you should always hash this. Why do we hash stuff like passwords at all?