4 ms·
They were pretty much only ever used as a blocker for your email being spammed. As in there's very very few sites that would reset a password on a security ques
by AnotherGoodName 2y ago
They were pretty much only ever used as a blocker for your email being spammed. As in there's very very few sites that would reset a password on a security question alone. The security questions purpose was just to avoid people triggering emails/resets to the wrong second factor. Despite the common belief they are worthless security questions they are perfectly fine when they don't reset the password directly and merely block users from mistakingly triggering a reset to a second factor on an incorrect account.
Do you know the common alternative to not using security questions in the above step? Doing absolutely nothing and allowing randoms to annoy you hitting your second factor with password resets. The ultimate place you rely on either way was the second factor and the questions were always better than nothing at all.
- ptsneves 2y agoAs a ceo, you just call the IT department directly and that is that. In the it’s just tubes analogy sense, it is all just people at the end of those tubes eventually.
- warhorse10_9 2y agoWhat you just described is incredibly prone to social engineering.
- ptsneves 2y agoHave real people go to the office of the CEO and have the CEO make the reset request in person. Even by phone a reset is harmless if the computer the ceo is using is known to be trusted and company managed. The defense is in depth not circumstantial to one single phone call or method. You can also authenticate the request through other channels.
- jowea 2y agoOh so I guess the "please fill in your reset email" counts as a security question. Makes much more sense thank you.