6 ms·

These are all big problems, but one incredibly common security anti-pattern out there that I never see talked about are the "security questions" that so many we

These are all big problems, but one incredibly common security anti-pattern out there that I never see talked about are the "security questions" that so many websites use to let you reset your password. It's amazing: a website will make me choose an 8-character (but not more than 14!) password with a number, a symbol, and at least one capital and one lowercase letter, but then it will let anyone who knows my birthday and favorite color change that password to whatever they like. (Obviously, I can opt out of this feature by typing gibberish into those answer fields, but do you think your grandfather will think to do that?) One variation that I know of that you can't opt out of it is on some banks' two-factor authentication, where they have you log in by answering a security question first, and then entering your password once you get the question right. The great thing about this is that it makes the bank an easy test-ground for guessing your security questions to use on other sites.

jiggy2011 14y ago
Usually the way this works (or should work) is that you answer the security question and then it emails you a new password. The reason for the security question is to prevent people who don't know you from being able to lock you out of your account. Of course this doesn't work so well if the person knows who's account it is and can find the answers to security questions online.
obiterdictum 14y ago
It's amazing: a website will make me choose an 8-character (but not more than 14!) password with a number, a symbol, and at least one capital and one lowercase letter, but then it will let anyone who knows my birthday and favorite color change that password to whatever they like. The most common implementation is to require to reset a password via a link sent in the email (and only then you answer security questions), which solves the particular problem you describe.
- mistercow 14y ago
  That has thankfully become more common recently, but many smaller sites never caught on.

jiggy2011 14y ago

Usually the way this works (or should work) is that you answer the security question and then it emails you a new password. The reason for the security question is to prevent people who don't know you from being able to lock you out of your account. Of course this doesn't work so well if the person knows who's account it is and can find the answers to security questions online.

obiterdictum 14y ago

It's amazing: a website will make me choose an 8-character (but not more than 14!) password with a number, a symbol, and at least one capital and one lowercase letter, but then it will let anyone who knows my birthday and favorite color change that password to whatever they like. The most common implementation is to require to reset a password via a link sent in the email (and only then you answer security questions), which solves the particular problem you describe.

mistercow 14y ago
That has thankfully become more common recently, but many smaller sites never caught on.