3 ms·
I really think secret questions are garbage. They grant minimal extra security for the cost of a huge hassle for customers. But the worst part about them is req
by protonfish 8y ago
I really think secret questions are garbage. They grant minimal extra security for the cost of a huge hassle for customers. But the worst part about them is requesting and storing a significant amount of highly personal data. The likelihood of this data being breached and used against you is probably much greater than the security improvements it grants. Requiring many pieces of personal data to sign up for every fly-by-night web application is short-sighted and inconsiderate.
- jechamt 8y agoI agree completely. The article above is pretty dated (which is noted in the post), and so leaves out some better options for security that are available today, such as authenticator apps for 2fa. In the context of when it was published, it was an excellent and important stepping stone in security awareness, but working with the tools of the time. Now, we have better options and Troy Hunt (among others) has covered many of them in separate posts over the years.
- zdwolfe 8y agoEspecially when websites use secret questions as a means to reset second factor..