4 ms·
"I hate security questions. I do not understand the need for them, or how they keep anything secure, when the questions they asks are always public knowledge."
by niggler 14y ago
"I hate security questions. I do not understand the need for them, or how they keep anything secure, when the questions they asks are always public knowledge."
Like with most things, security questions create a facade of security. Just like the "at least one lower case letter, one uppercase letter, one number, and one non-alphanumeric character" requirement of some sites: more often than not, the resulting password is "easier" to guess (many people put the numbers at the end, etc)
- r4vik 14y agothere's no reason for you to give them your actual mother's maiden name though, just tell them M)z&1<$Ccy(i]Kg&&dp` or something
- mctx 14y agoThat's a great idea for online services, assuming that they don't have strict validatation ("your mother's maiden name can not contain symbols"). I'm not sure it would work as well with companies who call you though.
- jzwinck 14y agoThat's right: someone who knows their credentials will be the focus of deliberate attacks should never use truthful personal details in response to these "security questions." Perhaps this is a "best practice" for anyone involved in such sensitive situations, even while the true best practice would be for sites to not allow password resets using such unreliable authenticators.
- ceejayoz 14y agoThis, incidentally, makes for fun conversations with phone support.