3 ms·
Why does everyone (including the big tech companies) pretend that security questions are secure and should even be mandatory? It's mind-boggling to me.
by yreg 7y ago
Why does everyone (including the big tech companies) pretend that security questions are secure and should even be mandatory?
It's mind-boggling to me.
- mytailorisrich 7y agoThe other day I called my insurance to reset my online password and couldn't remember the answers to any of the security questions (I shop around every year so I never had to call them since I registered my account with them). The person on the phone then just asked me a basic question about the policy, which I got right since I had the policy in front of me, and was then happy to change my password. Fantastic... not.
- pbhjpbhj 7y agoI realise it's not ideal, but it's an open question West you'd like them to do instead? Do you want them to refuse you service completely, for example?
- mytailorisrich 7y agoIf they are happy to ignore my answers to the security questions and go with other questions instead then they should scrap the security questions altogether. Otherwise, yes, they should refuse me service because the point is to use the security questions to establish whether I am who I am claiming to be.
- magashna 7y agoMFA. Security questions are easily socially engineered, especially when you need to choose from a list. What city was I born? One of the easiest things to find out about a person.