3 ms·

Please don't use recovery Q&A. As a user, I cannot trust that a website gets the recovery flow right. Some websites will allow you to bypass email and password

Please don't use recovery Q&A. As a user, I cannot trust that a website gets the recovery flow right. Some websites will allow you to bypass email and password if you know the answer to the question. Because of that, I cannot put in the real answer, as that would be a massive security risk. So I usually put in some random garbage, which means it's essentially a second password. Well, if I lost my first password, chances are good that I lost the second password as well. So please, don't do security questions. Just send a password reset link by email. If you're worried about stuff like payment info stored in the account, just ask me to re-enter those details after I changed my password.

DougWebb 9y ago
Fair points, and I'm not a fan of the recovery Q&A either. But here's the process that I use: 1. User must enter their email address, and I send them an email with a recovery code. 2. After they enter the code, validating control of the email address, I show them the Question they chose and let them enter the answer. 3. After they enter the correct answer, I force them to update their password, and I send a confirmation email about the password update. The emails all provide contact information and ask the user to get in touch if they didn't initiate any of these actions. You're right about the answer being essentially a second password, and I treat it as such: only an encrypted hash is stored, type=password fields are used to enter it. One of my clients did request getting rid of the Q&A, which I was able to do pretty easily because email verification step and reset code were already implemented. On a personal note, I never use real answers for security questions. I use randomly generated strings, just like my passwords. If I can choose my own question I use a random string for that too.

DougWebb 9y ago

Fair points, and I'm not a fan of the recovery Q&A either. But here's the process that I use: 1. User must enter their email address, and I send them an email with a recovery code. 2. After they enter the code, validating control of the email address, I show them the Question they chose and let them enter the answer. 3. After they enter the correct answer, I force them to update their password, and I send a confirmation email about the password update. The emails all provide contact information and ask the user to get in touch if they didn't initiate any of these actions. You're right about the answer being essentially a second password, and I treat it as such: only an encrypted hash is stored, type=password fields are used to enter it. One of my clients did request getting rid of the Q&A, which I was able to do pretty easily because email verification step and reset code were already implemented. On a personal note, I never use real answers for security questions. I use randomly generated strings, just like my passwords. If I can choose my own question I use a random string for that too.