Slashdot Mirror
Study Shows "Secret Questions" Are Too Easily Guessed
wjousts writes "Several high-profile break-ins have resulted from hackers guessing the answers to secret questions (the hijacking of Sarah Palin's Yahoo account was one). This week, research from Microsoft and Carnegie Mellon University, presented at the IEEE Symposium on Security and Privacy, will show how woefully insecure secret questions actually are. As reported in Technology Review: 'In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study's participants could guess the correct answers to the participant's secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.'" Schneier pointed out years ago how weird it is to have a password-recovery mechanism that is less secure than the password.
I don't think many people would guess the name of my first pet was OIYNTDttye7it867t&%&^%&^T(
I guess everyone from the /. community already knew this.
I frequently fill out my "secret questions" with total random nonsense, like:
"What is bla times 12381?", A: "2823848232abc!"
I guess, if I can't guess it afterwards, noone else should be able too ;=) (providing the answer isn't easily brute forced)
They tell you to chose a difficult to guess password, checking that it is made up of letters and numbers, does not contain your name, etc. Then they ask you for an "easily remembered answer" to a question. This in effect is a secondary back-door password, which you are told to select with the opposite criteria to the main one.
Secret questions are only less secure than passwords if they tell you the password right away. But if they reset the password and email the new one to a pre-specified email account then just guessing the answer isn't enough; you'd have to have access to the victim's email account too.
This doesn't really work that well if the password is actually for someone's email account, though.
"A week in the lab saves an hour in the library"
The questions have to be so easy that the owner will -never- forget them... That means they pretty much have to be a defining characteristic in a person's life.
Favorite color, birth city, mother's maiden name, location of first job, favorite pet, etc etc.
While my friends couldn't name a couple of those, it'd be stupidly easy for them to get those answers from me in a normal conversation. Even strangers, around friends, have a good chance at it.
Also, my bank takes this a step further... Sometimes when you log in, it asks you one of the security questions after you put in the name and password. I've never felt this made much sense, but oh well.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Who has more water that we expect to?
What is the surprise? They don't have to follow the same rules as passwords (letters and at least 1 number, etc) that many sites enforce. Plus, if they don't let you make your own question, they pretty much stick to the same stupid, generic 5-8 questions they all have.
If someone was really wanted to go on a phishing expedition, they would open a site that requires registration, security questions, and all that, and then try the information on the webmail of the people who just registered. Probably would work phenomally as well.
If websites wanted to be truly secure, they would ask for a mailing address or at least a phone number to confirm resetting things (thinking of financial accounts, not stupid forums). They confirm the same inane, easily duplicable facts in real life, but at least they have to reach you at a confirmed safe location.
You just gave it all away! Now we know that the question was "what is your sexual orientation" ...
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Secret questions are way to easily guessed. They should just stick to the most reliable password of all, mother's maiden name. Who the hell else would know that?
== Jez ==
Do you miss Firefox? Try Pale Moon.
#0099CC
Yep, security-savvy users do that because they know that's just wrong, the problem is companies pushing that security measure when it actually undermines their security efforts. It's like they're really asking for accounts to be broken in.
You just got troll'd!
I just keep a gpg-encrypted file with all my passwords. When sites ask these retarded questions, I just generate a long random alphanumeric string (using a little perl script), and save it in my gpg file. This file is heavily backed up. I cannot imagine a scenario where I would lose a password, or the answers to "secret questions".
The only time I've had a problem is with stupid websites that require registration (and I don't care about, so didn't write down the gibberish I wrote in their registration form) and some time later I decided to come back to that stupid site.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
#0099CC
Great. Now I have to change the combination on my briefcase...
You just submit the hash of your answer as the real answer? This would outwit a sizeable proportion of attacks by people who know you, as they might be unlikely to guess that you'd do this, and even if they do, they'd still have to guess the hash type.
:P
Then again, if they truly know you, then maybe they'd guess you'd be this paranoid
Q What is the highest prime number?
Q In 60 characters, prove Goldbach's conjecture
Q How many palindromic primes are there in base-10?
Q What is the lowest Sierpinski numer?
Q Solve the Happy Ending problem for arbitrary n
Q Prove or disprove that the Euler-Mascheroni constant is irrational in 60 chars.
Crack my account and I'll use your idea ^^
Knowledge is power. Knowledge shared is power lost.
If I'm allowed to choose the question, I use the time-tested method that was used in 80s games, which is "word in page x, line x, x-th word". If I'm not, it's usually a "pet" or "mother's name" question and I use the characters names or animals in the book.
I also use the book as a source for passwords for the many accounts I have everywhere on the internet. I spell out the login name in the book (say "Mylogin") by looking for the first word starting with "M", then the next word with "y", then the nex word with "l", etc... until I find a word that starts with "n", use the very next word that's 8 characters or more, append the line number, and that's my password.
I usually remember most passwords I use all the time, but for the accounts I seldom use, the book title is the only thing I need to remember to recover my passwords. Given the size of my library and the fact that the book is a huge, boring French novel, tough luck even for a burglar to find it.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Shame I just used my mod points. There are plenty of cultures in which women don't change their names when they marry, and even in those where they do they tend not to change them unless they marry, which is becoming less common. Fortunately banks are starting to wake up, and maybe in a decade they'll all have semi-sensible account security.
Yes, but "Where are the bodies buried?" isn't really the question you want to choose for password recovery.
That's a bit much. I rather enjoyed reading Les Miserables.
The problem comes with those idiot services that try to be too clever by half, and ask a battery of questions ("what was the name of your first grade teacher" "what was your first dog's name") and other such worthless trivia. These fields are required, and cannot be skipped. One day, the site decides to be clever again (I can picture some nerd furiously beating off as he thinks about his great idea) and asks me what's my favorite color when I log in. I mean, if I forget my password, that's my problem. But using these personal questions as some sort of CAPTCHA or user verification is just stupid.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
I dimly remember I saw something like this on /. before...
It's a no brainer. Or at least it should be. Most of those "secret" questions draw from a limited set of possible answers. Worse, ALL those answers will be found in a dictionary. Because they invariably ask for (*drumroll*) a real, usually English, word.
Now, what do we tell people, what did we tell them for ages? DO NOT use words that can be found in a dictionary. Yet for the "secret answer" (which is in almost all cases as good as the real password) we ask for a word that can be found in one.
Is it me or is this like, you know, STUPID?
There is no "secure" word. Not even your pet's name. My first pet was called ;drop table *;, btw. Yeah, I'm such a geek... sorry 'bout your database, btw.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Is this the study that was conducted by 4chan during the election? Where they found that 100% of Sarah Palins have easily guessed Yahoo mail security questions?
So, it seems every slashdotter is submitting his best SHA1 fancy trick to answer the security question. But I think you missed the problem. The problem is not securing the accounts of smart tech-savvy people, as they should already know how to do it themselves. It is "how do we make sure that Joe the Plumber, Granny, and Sarah do not set dumb-ass security questions leading their account to be pwned in less than ten seconds?"
My first program:
Hell Segmentation fault
Schneier pointed out years ago how weird it is to have a password-recovery mechanism that is less secure than the password.
Trump that: E.E. 'Doc' Smith pointed out sometime in the 1930s that what the world really, really needed was a foolproof way of establishing someone's identity. Unfortunately, his solution was to have some omnipotent aliens come up with a magic identity bracelet, which isn't particularly helpful.
That's the real problem - these dumb-ass methods of establishing identities come about because there is no good solution on offer to let a service provider check that you are who you say you are - and no way do we trust our wonderfully tech-savvy governments or industries to set up and run one.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
Regretably a few sites I visit regularly (including my bank) may prompt me for these questions, so a question of "Mash the keyboard!" and an answer of "alsjdgiosadln" no longer works.
Instead, as someone already stated, I select a secret question of "What is my password?" and if it's necessary for a second, "Type my password backwards." (answer: drowssap)
And finally, if it's a question to be asked by a human (tech support for an ISP I know of does this now), the question is something silly. As fun as "What are you wearing?" would be, I have sympathy for the employees and instead have "The Joker is invading Gotham - what do I do?"
i, too, have always deplored the secret question. so many sites force you to use them but they are really just insecure back doors into your account.
my solution? for years i've been treating passwords and secret questions as two fields each, delimited by a non-alphanumeric. for example: say my mother's maiden name is "harris", i and i'm entering it as a secret answer on amazon.com. i would answer "amazon*harris". for passwords, i have a standard password, for example, "ninjasinmypants". at amazon.com, my password would be "amazon*ninjasinmypants". that way my password is different from site to site, but still easy to remember.
add some password common-sense, e.g. not using dictionary words, and you end up with pretty strong passwords that are easy to remember.
Not filling them out is dangerous. If you don't fill them out then a question is selected by default. No answer is still an answer. A reasonable guess to 'the answer' is nothing, or rather, I didn't fill it out.
I imagine an operator asking: What is your mother's maiden name? Then the perp being stumped, and after a period of silence, the operator determining that the question was answered correctly.
And a machine is almost guaranteed to be that dumb.
...
Here in Australia the Federal government department Centrelink (who are responsible for welfare, student support etc) make you answer a secret question every time you log on to their online system. Which is moronic as your user name is your customer ID you aren't supposed to give out, and they enforce strong passwords.
Funny thing is that when you set a decent secret question you probably won't remember the answer over a year later (to clever for my own good). Of course their system is "smartly" designed and you can't get rid of your old questions just make new ones. So now I have about five questions I can't remember the answer to and twenty that are along the lines of "What is your name?" and I just hit refresh until I get an easy one.
Remember folks if you make your security too tight people will just write their passwords on a sticky note and put it on their monitor.
========
CINC, 4th Penguin Legion
Yeah, nobody would guess Natalie Portman...