4 ms·

This is why you never use the actual answer to that question, but actually a separate password for those.

• csallen 14y ago
  That wouldn't help. For example, let's assume your question was, "Who was your favorite teacher growing up?" and your answer was "fish123jellybean456". If that answer is stored in plaintext (no encryption) in a database that's compromised, then it won't matter that it's not the "real" answer. Attackers will see it, and then use it to answer your security questions on other sites. The only way to protect against this is to ensure you use different answers on different sites. Using a password instead of the correct answer to the question can be helpful, but in a totally different way. Specifically, it eliminates the risk that someone can guess (or research) the answer to your security questions.
  • notJim 14y ago
    Presumably you would use a different answer on every site.
  • drucken 14y ago
    For most people savy enough to use an arbitrary answer, it is because you can use a different one each time (with the very few exceptions where you may not be able, e.g. banks). Offline portable password managers like Keepass/Password Safe/etc. are immense help for these non-bank services.