Slashdot Mirror
Study Shows "Secret Questions" Are Too Easily Guessed
wjousts writes "Several high-profile break-ins have resulted from hackers guessing the answers to secret questions (the hijacking of Sarah Palin's Yahoo account was one). This week, research from Microsoft and Carnegie Mellon University, presented at the IEEE Symposium on Security and Privacy, will show how woefully insecure secret questions actually are. As reported in Technology Review: 'In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study's participants could guess the correct answers to the participant's secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.'" Schneier pointed out years ago how weird it is to have a password-recovery mechanism that is less secure than the password.
I don't think many people would guess the name of my first pet was OIYNTDttye7it867t&%&^%&^T(
I guess everyone from the /. community already knew this.
I frequently fill out my "secret questions" with total random nonsense, like:
"What is bla times 12381?", A: "2823848232abc!"
I guess, if I can't guess it afterwards, noone else should be able too ;=) (providing the answer isn't easily brute forced)
Question: What is your favorite color?
Answer: 37Uhy78jn
Good luck on nailing that anytime soon.
Next . . .
It's all history, man. -anon
They tell you to chose a difficult to guess password, checking that it is made up of letters and numbers, does not contain your name, etc. Then they ask you for an "easily remembered answer" to a question. This in effect is a secondary back-door password, which you are told to select with the opposite criteria to the main one.
This is why when I'm forced to have a secret question / answer I always use gibberish.
I reason that in the unlikely event I forget my password I'd rather have the hassle of going through a more long-winded retrieval process than having random people able to reset my password.
We did this to a friend when I was still at school - "Forgot" his Yahoo Mail password, guessed his secret answer and reset his password. No malicious intent, we just enjoyed winding him up, but I reckon a good 15 or 20 people that I knew could have guessed his answer correctly.
Radomness and strangeness are your friends when it comes to this sort of thing. I don't think too many people would guess one of mine (obviously no longer in use)
Q: How many Alsations mime to rice ?
A: Egyptian Eskimo Chess
Of course it helps if such systems at least allow you to set up your own questions as that is entirely memorable to me :)
It also confused the hell out of my bank when my memorable date was too far in the future for it's system to cope with. That soon made me switch banks to one with a half decent system !
Sky subscribers are morons. They pay to be advertised at !
Secret questions are only less secure than passwords if they tell you the password right away. But if they reset the password and email the new one to a pre-specified email account then just guessing the answer isn't enough; you'd have to have access to the victim's email account too.
This doesn't really work that well if the password is actually for someone's email account, though.
"A week in the lab saves an hour in the library"
The questions have to be so easy that the owner will -never- forget them... That means they pretty much have to be a defining characteristic in a person's life.
Favorite color, birth city, mother's maiden name, location of first job, favorite pet, etc etc.
While my friends couldn't name a couple of those, it'd be stupidly easy for them to get those answers from me in a normal conversation. Even strangers, around friends, have a good chance at it.
Also, my bank takes this a step further... Sometimes when you log in, it asks you one of the security questions after you put in the name and password. I've never felt this made much sense, but oh well.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
People who use unsecure password will use unsecure retrieval question. Guess what is the problem? Worse, once their uber secure password is stored on their navigator, they will use a simple question. In the end, the user is almost ever the problem.
I usually use something personal enough so that nobody else, even my girlfriend, knows the answer.
Stupidity is the root of all evil.
Who has more water that we expect to?
What is the surprise? They don't have to follow the same rules as passwords (letters and at least 1 number, etc) that many sites enforce. Plus, if they don't let you make your own question, they pretty much stick to the same stupid, generic 5-8 questions they all have.
If someone was really wanted to go on a phishing expedition, they would open a site that requires registration, security questions, and all that, and then try the information on the webmail of the people who just registered. Probably would work phenomally as well.
If websites wanted to be truly secure, they would ask for a mailing address or at least a phone number to confirm resetting things (thinking of financial accounts, not stupid forums). They confirm the same inane, easily duplicable facts in real life, but at least they have to reach you at a confirmed safe location.
Secret questions are way to easily guessed. They should just stick to the most reliable password of all, mother's maiden name. Who the hell else would know that?
== Jez ==
Do you miss Firefox? Try Pale Moon.
I just keep a gpg-encrypted file with all my passwords. When sites ask these retarded questions, I just generate a long random alphanumeric string (using a little perl script), and save it in my gpg file. This file is heavily backed up. I cannot imagine a scenario where I would lose a password, or the answers to "secret questions".
The only time I've had a problem is with stupid websites that require registration (and I don't care about, so didn't write down the gibberish I wrote in their registration form) and some time later I decided to come back to that stupid site.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
We all have our little secrets. It's not hard to find a question/answer nobody else could figure out... Unless you are such a nice, innocent and transparent person, like Sarah.
Anyways, this is an old topic and /.ers are intelligent people...
You just submit the hash of your answer as the real answer? This would outwit a sizeable proportion of attacks by people who know you, as they might be unlikely to guess that you'd do this, and even if they do, they'd still have to guess the hash type.
:P
Then again, if they truly know you, then maybe they'd guess you'd be this paranoid
Q What is the highest prime number?
Q In 60 characters, prove Goldbach's conjecture
Q How many palindromic primes are there in base-10?
Q What is the lowest Sierpinski numer?
Q Solve the Happy Ending problem for arbitrary n
Q Prove or disprove that the Euler-Mascheroni constant is irrational in 60 chars.
Crack my account and I'll use your idea ^^
Knowledge is power. Knowledge shared is power lost.
If I'm allowed to choose the question, I use the time-tested method that was used in 80s games, which is "word in page x, line x, x-th word". If I'm not, it's usually a "pet" or "mother's name" question and I use the characters names or animals in the book.
I also use the book as a source for passwords for the many accounts I have everywhere on the internet. I spell out the login name in the book (say "Mylogin") by looking for the first word starting with "M", then the next word with "y", then the nex word with "l", etc... until I find a word that starts with "n", use the very next word that's 8 characters or more, append the line number, and that's my password.
I usually remember most passwords I use all the time, but for the accounts I seldom use, the book title is the only thing I need to remember to recover my passwords. Given the size of my library and the fact that the book is a huge, boring French novel, tough luck even for a burglar to find it.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
I have a list of some ~150 accounts and passwords on paper in an unlocked cupboard. They are forum accounts, accounts to online communities (digg, etc.), online stores, to my less important emails, to some FTP servers, etc. etc...
I don't need to worry about harddrive breaks or hackers - everything is on paper and offline. I don't need to worry about my family members wanting to log into my driveThruRPG online store account - why would they want to? And even if they did they could do nothing without my paypal account.
There are only a few passwords that aren't on the list - my private e-mail, my work e-mail, my paypal, logins to my home and work computers and login to the encrypted partition on my hard drive.
I don't use the same password in any two places. Only flaw of this is that if I were to lose that list (probably due to my house burning down) I would have to recover a lot of passwords. However, in such event the password recoveries would be the last thing to worry about...
Shame I just used my mod points. There are plenty of cultures in which women don't change their names when they marry, and even in those where they do they tend not to change them unless they marry, which is becoming less common. Fortunately banks are starting to wake up, and maybe in a decade they'll all have semi-sensible account security.
That's a bit much. I rather enjoyed reading Les Miserables.
The really sad thing is that it takes
research from Microsoft and Carnegie Mellon University
and that they have the balls to
present[ed] [it] at the IEEE Symposium on Security and Privacy
If you know about date formats, you know there is only one. ISO 8601.
The worst are the ones that force you to have a "secret" question. Oh like its that hard for an acquaintance to guess your high school, or your mother's maiden name?
Usually I just create a second password (I'm sure somewhere my mother's maiden name is inwyd15), but even that is one more thing that can get loose.
That's a standard that defines a format, not a format by itself, regarldess it's also one of many standards, although many of those are obsolete now. Still, there are plenty more than just one single date format however you cut it!
But the point is that on some days you'll use 20/3/2009, other days you'll use 20/03/2009, then you might use 20th March 2009 and all that's assuming just a single date ordering from days to years which is common in Britain but not so in the US which uses months, days, years or Europe which mostly follows years, months, days.
That's why I only use one secret question.
"What is my password for this site?"
The problem comes with those idiot services that try to be too clever by half, and ask a battery of questions ("what was the name of your first grade teacher" "what was your first dog's name") and other such worthless trivia. These fields are required, and cannot be skipped. One day, the site decides to be clever again (I can picture some nerd furiously beating off as he thinks about his great idea) and asks me what's my favorite color when I log in. I mean, if I forget my password, that's my problem. But using these personal questions as some sort of CAPTCHA or user verification is just stupid.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
I dimly remember I saw something like this on /. before...
It's a no brainer. Or at least it should be. Most of those "secret" questions draw from a limited set of possible answers. Worse, ALL those answers will be found in a dictionary. Because they invariably ask for (*drumroll*) a real, usually English, word.
Now, what do we tell people, what did we tell them for ages? DO NOT use words that can be found in a dictionary. Yet for the "secret answer" (which is in almost all cases as good as the real password) we ask for a word that can be found in one.
Is it me or is this like, you know, STUPID?
There is no "secure" word. Not even your pet's name. My first pet was called ;drop table *;, btw. Yeah, I'm such a geek... sorry 'bout your database, btw.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
That's a bit much. I rather enjoyed reading Les Miserables.
OT I know, but did your really enjoy the ~5 pages spent describing some villains who then contribute 1/2 a page of actual plot?
Having said that, overall I did like it, but I think Dumas' "Three Musketeers" is a far more enjoyable read.
Is this the study that was conducted by 4chan during the election? Where they found that 100% of Sarah Palins have easily guessed Yahoo mail security questions?
I always use the first name of my first real girlfriend. But then, that's not going to be much use for many slashdotters. But then, you can also use the first name of your faux girlfriend. Her name is even more secret !
Religion is what happens when nature strikes and groupthink goes wrong.
So now we need studies to show that "secret questions" are insecure.
Is computer science getting boring?
what is your favorite color?
Any guess???????
Did you ever read John Le Carrés "A Perfect Spy"? In that, the one time key was a copy of Simplicissimus. Lose the book, career over. (I'm paranoid too, I used to use Weingreen's Hebrew Grammar until the day I had to rescue it from the Oxfam pile...)
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
I prefer to make up a cryptic crossword clue, but one which only I could know the answer to. Here's an example: "Red Cross indebted to largesse (9)". Don't bother trying to guess the answer - it involves two uncommon languages, and some personal quirks. It's also more than 9 characters long.
For those "first pet" idiot questions, I typically choose an extinct species, but not any of the well-known ones, and add a non-alphameric character (like Elrathia^kingi or Charnia_masoni, although I have not used those particular examples). An analogous approach works for "mother's maiden name" and other such security challenges.
This approach has served me for years, and I can always remember the passwords...
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
No duh,
No duh,
No duh,
No duh,
No duh.
By the way, can you guess what my secret answer might be?
In all seriousness, with social networking sites, don't you think someone's secret answer can be found there? Pet's name, for example?
I remeber having to make a choice of crappy questions and the result is that I put a load of gibberish as the answer.
So I forget password one day and get asked the question...then after several attempts start shouting at the PC - What do you mean my favorite sport is not squash? And don't tell me I wasn't born in a hospital ward!
Due to the stupid questions that have been asked.
Quite a few sites have begun adding "Roll your own question" options as well.
These ones are much safer to use.
But of course, if you do have one of those sites with the usual crap, just don't answer them directly.
Moms maiden name? How about Steve?
First Pets Name? Tyrannosaurus Fuckyou?
Favourite colour? Urple. (bonus points for those who get the reference.)
But then you have stupid idiots like Sarah Palin who enter their own question with something so easily identifiable. (a fucking zipcode? Holy hell woman)
So, back to square one it seems. Damn my 2 sided thoughts always balancing out.
You can also opt for a default answer, with a variable question.
Let's say you choose a simple answer that is easily remembered, like the name of the street you live in, i.e. Oakley road.
No matter what question you choose, your answer will always be Oakley road.
For example:
Question : What is your mother's name?
Answer : Oakley road.
In this case you only have to remember what question you chose.
Safe? Depends. It's sure as hell a lot harder to guess than actually answering the question.
When I have to fill out a "secret question" with an answer that's all too easy to look up, I just make up an answer no one will figure out but me. If someone trying to get into my account tries to guess what was "the color of my first car", how are they going to know the answer if I made up a word that doesn't even exist?
Just pick one word you use to answer all questions, like "love2canoo" or something. Why put in answers people can guess? Just make up a single answer that answers all questions.
For example:
1) Mother's maiden name: love2canoo
2) First pet: love2canoo
3) First car: love2canoo
That way everyone trying to guess your answers will always be wrong. I'm not sure why people think they really need to answer those things truthfully. Lie, and others trying to use the truth will fail.
I always choose the question "What is your mother maiden name ?", and answer my pet name...
I swear Officer, these are not WMD, just plain French cheese...
I don't get this. I don't fill out secret question answers if I don't have to, prefering to just have the regular password, but if I do fill them out, for-gods-sake my answer wouldn't be the answer to the actual question, it would be something random like the password!
Answering the actual question is obviously flawed security.
Pete Boyd
A credit web site asked me for the name of my first pet. I entered the answer which was "meg" (a spaniel).
This failed validation for being too short.
So, it seems every slashdotter is submitting his best SHA1 fancy trick to answer the security question. But I think you missed the problem. The problem is not securing the accounts of smart tech-savvy people, as they should already know how to do it themselves. It is "how do we make sure that Joe the Plumber, Granny, and Sarah do not set dumb-ass security questions leading their account to be pwned in less than ten seconds?"
My first program:
Hell Segmentation fault
Schneier pointed out years ago how weird it is to have a password-recovery mechanism that is less secure than the password.
Trump that: E.E. 'Doc' Smith pointed out sometime in the 1930s that what the world really, really needed was a foolproof way of establishing someone's identity. Unfortunately, his solution was to have some omnipotent aliens come up with a magic identity bracelet, which isn't particularly helpful.
That's the real problem - these dumb-ass methods of establishing identities come about because there is no good solution on offer to let a service provider check that you are who you say you are - and no way do we trust our wonderfully tech-savvy governments or industries to set up and run one.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
"Also, neither would you. Hence, rendering the whole facility useless, and causing you extra inconvenience."
;)
Not really, he just keeps OIYNTDttye7it867t&%&^%&^T( in a text file near his root directory called passwords.txt
There are 10 kinds of people in the world... those who understand binary and those who don't.
Ahhh this reminds me of all the interesting things you could find about random people in their Hotmail (and I think Yahoo) mail accounts...
You only needed to do a global search for ICQ profiles (that matched some of your criteria like having a hotmail) and look for the "filled" profiles...
From there you went from hotmail and asked for a "forgotten password"... form, usually it will ask you things like your date of birth or other stupid info like that and more usually than not, the secret question was "where were you born, etc".
I guess something similar could be achieved with today's Facebook... the only difference is that the contact information is private by default :(
"What's the difference between an orange?"
The only time I've run into these being used is as a second layer after they send a hashed URL to my email address, so the attacker would have to have known which email account on which server I was using, then discovered the password to my mail account or set up a MITM attack on my mail server, before they even got to the secret question part.
So that means the average person should be able to guess the name of my first pet in 6 guesses, right? Go ahead. Try.
There is no -1 Disagree mod. Slashdot.org/faq defines mod options. USE IT.
Ach, I hate sites like that. Even if I wanted to, I can't remember my grade school teachers' names. And if I make up something spontaneous, I am guaranteed to forget it later... It's almost as irritating as all the different password guidelines out there: with or without special characters, digits, capital letters, etc, etc.
Enjoy life! This is not a dress rehearsal.
Regretably a few sites I visit regularly (including my bank) may prompt me for these questions, so a question of "Mash the keyboard!" and an answer of "alsjdgiosadln" no longer works.
Instead, as someone already stated, I select a secret question of "What is my password?" and if it's necessary for a second, "Type my password backwards." (answer: drowssap)
And finally, if it's a question to be asked by a human (tech support for an ISP I know of does this now), the question is something silly. As fun as "What are you wearing?" would be, I have sympathy for the employees and instead have "The Joker is invading Gotham - what do I do?"
the Spanish Inquisition!
i, too, have always deplored the secret question. so many sites force you to use them but they are really just insecure back doors into your account.
my solution? for years i've been treating passwords and secret questions as two fields each, delimited by a non-alphanumeric. for example: say my mother's maiden name is "harris", i and i'm entering it as a secret answer on amazon.com. i would answer "amazon*harris". for passwords, i have a standard password, for example, "ninjasinmypants". at amazon.com, my password would be "amazon*ninjasinmypants". that way my password is different from site to site, but still easy to remember.
add some password common-sense, e.g. not using dictionary words, and you end up with pretty strong passwords that are easy to remember.
One of the questions that Bank of America uses to verify your identity for helping over the phone is 'Which branch did you open your account at?" But then, for some people, they have a trick answer. For some reason, B of A unilaterally changed that information for my account, and then expect me to give the false answer in order to access my account. They can't explain why it was changed, and are incapable of setting it back to a true answer. I argued this all the way up to the Office of the President, and nobody there would even acknowledge that it was a bad precedent for them to insist that a customer intentionally lie to them.
To make matters worse, their customer service claimed to be able to leave a note instructing agents not to ask that particular question. However, the note doesn't appear on their screen until AFTER they have asked their stupid questions.
P. Orin Zack
+ + +
Read my fictional account of corporate incarceration in the Business Short Stories section at http://klurgsheld.wordpress.com/
Here in Australia the Federal government department Centrelink (who are responsible for welfare, student support etc) make you answer a secret question every time you log on to their online system. Which is moronic as your user name is your customer ID you aren't supposed to give out, and they enforce strong passwords.
Funny thing is that when you set a decent secret question you probably won't remember the answer over a year later (to clever for my own good). Of course their system is "smartly" designed and you can't get rid of your old questions just make new ones. So now I have about five questions I can't remember the answer to and twenty that are along the lines of "What is your name?" and I just hit refresh until I get an easy one.
Remember folks if you make your security too tight people will just write their passwords on a sticky note and put it on their monitor.
========
CINC, 4th Penguin Legion
Set the secret question/answer up Jeopardy style.
People who you trust, are more likely to know more details about your life. So, of course, they may come across information that could also be used for a secret question. But, then again, they are people you trust so it's less of a big deal. I've never known personally, and have only heard once on the Internet, of someone whose close friend cleaned out their bank account by guessing their secret questions.
The real problem is that 17% of non-trusted individuals were able to piece together some of those answers.
There is a possibility that people choose questions and answers that their nearest kin or friends could actually guess. In case of emergency or in the event of my death, there is the possibility that I would want my family to be able to access my main email.
Not all of my email, but definitely my main one...
My little brother, when he was 8 years old, decided to "hack" a little girl's email account. Her secret question was "What's my favourite colour?" He concluded that, since she is a girl, of course her favourite colour would be pink! Bingo! It worked, and he was able to reset her password. He wasn't clever enough to change her secret question so she was able to get back into her account.
Especially stupid and annoying are the questions that assumes everyone on the internet is an American, or at least follows American culture.
("What state was your high school in?", "who is your favorite baseball team?" etc)
From the time when you open your account to the time you first log in to the home banking system, your password is the last four of your SSN. Thanks, assholes. On the plus side, they only use secret questions to enhance login security (ever so slightly) by making it inline connecting from anyplace you haven't manually instructed their website to place a cookie on the system.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Not sure if this was said before but one of the problems is that a lot of login systems do not let you choose your own question AND answer. You instead have to choose from a set of pre-defined (and probably very easily guessed) questions to which you can attach your answer. This prevents you from using the secret question as a secondary/alternate password. On top of that, some people just choose something highly memorable but easily guessed (much like their password itself is likely to be). I think your best bet is to just enter a nonsense answer (that doesn't reflect the question) but you then need to remember what that was should you ever have to retrieve your account details.
About a month ago, I had to make a bunch of tech support calls to my now former ISP for my business connection. A couple of years ago when I established the account, they asked me to create one of these, but this one was rather unusual in that I could choose any question I pleased. I chose "why should this type of 'security' never be used?" with the answer being "inadequate security." I had to answer that question over the phone about fifteen times over the course of a month, which took a little bit of the pain out of dealing with the incompetence at this ISP. Only a couple of the reps I spoke with seemed to get the joke, or (very likely) most of them didn't care.
Several vendors, who I will kindly not name (you know who you are), have a nasty habit of using secret questions that are based around the concept of one's "favorite" things. It never occurs to them that one's preferences and favorites might actually change over time! What happens to the usefulness of such questions when what you favor has changed a year after you originally chose the question and its answer? Then it becomes a headache of trying to recall your past state of mind, similar to trying to recall former e-mail addresses used to set up online accounts.
At the very least, if vendors feel a need to rely upon such secret questions as a security tool, the questions chosen should be OBJECTIVE and not dependent upon a person's emotions or state of mind. State of mind is malleable.
"Yeah, so my dogs name is Rufus, whats yours?"
"Fido huh? MWahahaha!"
True story. When someones been playing Runescape for half their life playing Runescape they tend to forget their "secret question" and the need to keep it secret.
Only wimps backup their password to a sticky notes: _real_ men just upload their important passwords on ftp, and let the rest of the world mirror it ;)
The answers to my secret questions are always lies. I don't want to have to keep my mother's maiden name a secret, and if a friend asks the name of my first pet, I want to be able to answer honestly.
This is the part "security specialists" don't get: when it comes to humans and security, it's all about the *context* in which the negotiation between perceived risk, convenience and reward takes place. A study such as this is trying to study the wrong thing. It's not the fact that people choose insecure passwords, or guessable questions - everyone knows that - it's WHY THEY DO that matters.
Here's a hypothetical scenario. You are asked to create an account on a site called "wobble your bum cheeks" which lets you uploads pictures of your behind and make them look like they are wobbling hilariously. As part of the signup process, you are asked to choose a password. What do you do?
a) Choose something you are unlikely to forget (like "password" or "forgetmenot")
b) Choose a strong password like (like "L0Lcatz" or "baz00kas")
c) Don't bother to sign up
Thinking about those choices, what sort of things run though your mind? How is the dialogue between perceived risk, convenience and reward panning out? Now add some extra spice: the site demands you also choose a security question. Same three options broadly apply. Same negotiation.
Now repeat the above in a different context: applying for an online bank account. Now what do you do? Do you see where I'm going with this?
FAR, FAR more research is needed into CONTEXTUAL security - the "human factors" around it and the reasons WHY people exhibit certain behaviours when faced with the above negotiation. Until then, TFA can kiss my dick. Who cares. Really.
"And the meaning of words; when they cease to function; when will it start worrying you?"
My answer to the secret question has always been a random key sequence and a mental note not to trust the security of this obviously incompetent service.
I had a registrar confirm my identity by asking me to answer the secret question I setup. The question I made up was was "What is the fucking point of this security question bullshit?" Unfortunately I couldn't answer the question because I was laughing so hard hearing him read it with a thick Indian accent.