Security Questions considered harmful

Monday, May 24th, 2010

Many online services allow, or even worse, require, the so called “Security Question”. It is a question/answer you can enter in case you ever forget your password or can’t access your account for some reason. In my opinion, security questions are an incredibly bad idea, from a security perspective.

The usual security questions are things like “What was your mother’s maiden name”, “What’s your pet’s name”, etcetera. People won’t understand that actually supplying a truthful answer to these kind of questions exposes them to an incredible weakness in their account’s security. These are all questions to which the answer can be found relatively easy by googling a person or applying a little social engineering. “Hey, I am John, and I think I might be related to you on your mother’s side. What’s her maiden name”?

The worst part is that every site has basically the same questions from which you can choose. This means that people either have to pick the same question and answer every time, or pick a different one for each account. The first will make them vulnerable to repeated attacks on all their online profiles once an attacker has found the answer. The second will make it very hard for people to remember that they must never let anybody know about their favorite pet’s name “Buddy”. A lose/lose scenario at best.

As is often the case with security protocols, they must be followed to the letter to be safe. One flaw in the procedure, and the security collapses. Security questions could be a good idea, provided that:

• The user makes up his own question. No predefined questions should be supplied, and most importantly, different sites shouldn’t all use the same questions.
• The user should never be told what his security question was. If they need to reset their password, they should chose both the security question and the answer. This will make it much harder for a potential attacker to gain accees.

Of course, taking the above in consideration, security questions are just as hard to remember as a password, which makes them kind of pointless. Pointless or insecure, make your pick.