3 ms·

You're not supposed to put in real answer anyway.

• cryptoz 12y ago
  I usually use an answer like securityquestionsshoulddieinafire [1], no matter the question. Easier that way, and more satisfying. [1]: No, not that exact string ;)
  • samspot 12y ago
    it works until they limit your to 10 characters, now you have an exception you will never remember!
• electromagnetic 12y ago
  I usually switch the answers around. So A gets B's answer.
• personZ 12y ago
  This sort of comment appears a lot and it makes for an easy trip to victim blaming. Apple created these questions for you to enter real answers. They fully intend for you to put in real answers. That is what the system's purpose is. That we look at it and say "well that is grossly insecure, so I'm going to put in the SHA512 hash of the question with a fixed secret salt" might assuage our risk, but it does nothing to relieve Apple of the failure of this security system.
  • AlexandrB 12y ago
    Not only is it insecure, but in some cases intensely user unfriendly. I used to put real answers in these until I realized even if I remembered the answer I could never recall the exact string I used. A common example: "Name of first car?" So was that "Neon"? or "Dodge Neon"? or "Blue Neon"? or maybe "neon"? or "1991 Dodge Neon"? Security questions are basically a secondary password masquerading as something else. But because they are not called a password, the expectations on their character-wise-correctness are not clear to a layman. I find the continued proliferation of security questions baffling, especially when some sites call password + security question "two factor authentication".