4 ms·
Authenticating users with passwords and "secrets" such as your hometown, high school, or first street name are all ridiculous strategies. My not-so-inner cynic
by raganwald 18y ago
Authenticating users with passwords and "secrets" such as your hometown, high school, or first street name are all ridiculous strategies. My not-so-inner cynic suggests that banks know this but think they are safe from lawsuits as long as such methods are "industry standards."
- aamar 18y agoCan you suggest a better alternative? Currently, we use email/password for authentication, but if our user forgets their password, they can answer their security questions to reset it. To design our list of questions, we worked off of http://www.goodsecurityquestions.com/examples.htm http://www.goodsecurityquestions.com/examples.htm and tried to find questions which were relatively obscure, but not so obscure that users couldn't come up with answers. I suppose we can make "write your own question" an option, but we do think that most users given that option will write too easy a question, like mother's maiden name. Our app contains a lot of sensitive data, including medical data, and privacy of this data is incredibly important to our business. We have to be attentive to regulation and industry standards -- and you're right that industry standards probably give us some cover -- but we have both the desire and the flexibility to do the right thing.
- raganwald 18y agoThere are no easy answers if the scenario is that someone has "forgotten" their password AND you want to authenticate them using a web form that can be submitted anonymously from an arbitrary machine.
- klein_waffle 18y agoI think the banks also know that accounts are such high-value targets that criminals have better ways to steal, anyway. Straight up identity fraud is way more of a problem than account hacking.