3 ms·
Secret questions don’t help with security but tend to make it worse. Not only can they be phished conveniently along with the password, they also make for a poo
by Hackbraten 8y ago
Secret questions don’t help with security but tend to make it worse. Not only can they be phished conveniently along with the password, they also make for a poor UX. Also, SMS is no longer considered a secure channel. Use a more secure second factor instead, such as WebAuthn.
Blocking an account after a number of failed login attempts is an invitation for DoS. Use a system of temporary blocks instead; for example, 2^n seconds after the n-th attempt.
- happppy 8y agoI was reading about WebAuthn. What if my security key gets stolen?
- Hackbraten 8y agoOne common method is to secure the hardware key with a PIN. The key will only do its work (e. g. sign things) if the correct PIN is entered. It will also destroy the secrets it keeps (or even itself) after a given number of failed attempts. If this is not feasible for some reason, you need to change or revoke your secrets as soon as you know the key is stolen.