3 ms·
While I agree that they are useless, I don't mind the security questions that are used to reset one's password, provided that proof of email ownership is requir
by signed0 14y ago
While I agree that they are useless, I don't mind the security questions that are used to reset one's password, provided that proof of email ownership is required. These are just a minor nuisance.
The dangerous ones such as this allow someone to use the security questions in place of your password. These are less secure than if you were to use your place of birth and address as your password.
Their thought process probably goes something like "we can't have users giving us their password over the phone, anyone could overhear that and they would think it is insecure. Lets have them give us something less confidential instead".
Services like this that require verbal authentication via the telephone should generate a passphrase and email it to their uses upon signup.
- tjoff 14y agoSo, when signing up, how do you know what the security question is going to be used for? And how do you know that won't change? Any service that is sensible enough to give you that information will hardly make use of "security-questions" in the first place...