3 ms·
I have never come across an authentication mechanism that actually required your security questions. There's always another route to restoring your password, wh
by ouid 10y ago
I have never come across an authentication mechanism that actually required your security questions. There's always another route to restoring your password, which means that they do not serve a security function, but rather serve a convenience function, at the expense of security.
If you are willing to be brave about this then the best way of answering security questions is by typing a random string and NOT writing it down. You will never need that value again.
- mjevans 10y agoI once did that for a site which I didn't want anyone to recover my password to and thus break the security. I -DID- write down the actual password. Today, years later, I still can't login to the damn payroll site because there isn't a procedure for just completely resetting the password state of the account and it wouldn't let you log in without those extra things. Since that point I have recorded every annoying split-password (that's what the 'security questions' actually are, a forced split in the single real password)...