Secret Security Questions Are a Joke

Hugh Pickens writes "Rebecca Rosen writes that when hackers broke into Mat Honan's Apple account last week, they couldn't answer his security questions but Apple didn't care and issued a temporary password anyway. This was a company disregarding its own measure, saying, effectively, security questions are a joke and we don't take them very seriously. But even if Apple had required the hackers to answer the questions, it's very likely that the hackers would have been able to find the right answers. 'The answers to the most common security questions — where did you go to high school? what is the name of the first street you lived on? — are often a matter of the public record,' writes Rosen, 'even more easily so today than in the 1980s when security questions evolved as a means of protecting bank accounts.' Part of the problem is that a good security question is hard to design and has to meet four criteria: A good security question should be definitive — there should only be one correct answer; Applicable — the question should be possible to answer for as large a portion of users as possible; Memorable — the user should have little difficulty remembering it; and Safe — it should be difficult to guess or find through research. Unfortunately few questions fit all these criteria and are known only by you. 'Perhaps mother's maiden name was good enough for banking decades ago, but I'm pretty sure anyone with even a modicum of Google skills could figure out my mom's maiden's name,' concludes Rosen. Passwords have reached the end of their useful life adds Bruce Schneier. 'Today, they only work for low-security applications. The secret question is just one manifestation of that fact.'"

Comments

Simple solution

[Anonymous Coward]

Let people design their own question.

Re:Simple solution

[NeutronCowboy]

Even simpler solution: design your own answers. Yes, you'll get funny silences over the phone when you tell that the rep that you were born "On the moon", that the street you grew up on was "the yellow brick road", and that your mothers maiden name was Humpty Dumpty. The upshot is that no one can guess, the answers are meaningful to only you, there is only one answer (the fake, important name and place), and, because the answers are whatever you think they should be, applicable.

Re:Simple solution

[Hognoxious]

The problem is that if you don't use them very often (say only for a password reset) it's easy to forget what answers you gave.

On trick is to give true answers, but for someone else, i.e. you answer as if you were Linus Torvalds or Queen Victoria. But then you still have to remember who ...

Re:Simple solution

[fredprado]

And they are within their rights to do so and suffer the consequences for it.

Re:Simple solution

[PerfectionLost]

I had a friend who built an entire fake persona that she used to answer her security questions. Address, parents, pets, you name it.

In hind site she was probably a little schizophrenic.

Re:Simple solution

[Qzukk]

I once had an account on a site that asked me to select three questions from a list of a couple dozen then answer them.

When I needed to recover my password, it asked me to select the same three questions from a list of a couple dozen then answer them again.

I never managed to recover my password.

Re:Simple solution

[Isaac-1]

And as long as you always answer 42, or 416 what is the problem with that?

Re:Simple solution

[Anonymous Coward]

Mine is, "What do you hate about c++?" when it is optional. People are good at making up their own questions if they care. And security is only as good as you care about it. It is impossible to force people to use security despite the attempts.

Re:Simple solution

[MightyYar]

I don't think that would fly. If a person's bank account gets hacked, the bank usually (always?) picks up the tab. It's in their interests to get people to bank online - it is significantly cheaper than hiring tellers. If I were on the hook for security flaws at the bank, I'd never bank online.

Re:Simple solution

[Hythlodaeus]

The purpose of security questions is not security - its reducing customer service workload due to forgotten passwords.
In most implementations its an overall reduction in security, since the security questions constitute a backdoor to the password, rather than an additional factor of authentication.

Re:Simple solution

[MightyYar]

At the same time, expecting people to be security experts is not going to be successful. You might have a good grasp of it, but chances are you have some exposure to it. It might not occur to your proverbial grandma that people can track down her mother's name.

Re:Simple solution

[Sqr(twg)]

Or go to passwordmaker.org, and use the security question (all lower case and no punctuation) as URL and your own secret password. Set the character set to hex digits so that the answer is easy to read out over the phone.

Re:Simple solution

[bluefoxlucid]

The problem with that is I've got a 50% chance of getting it right. "Templates" or "operator overloading."

Re:Simple solution

[bluefoxlucid]

For phone stuff I set security questions like "Would you like to have dinner some time?" or "Wanna have sex when I get off?" and call to tease the cute customer service girl.

Re:Simple solution

[Anonymous Coward]

You mean the cute customer service Indian guy.

Re:Simple solution

[Hatta]

That doesn't solve the real problem, that banks think that these question and answers provide any sort of security whatsoever. What is the difference between this Q&A scheme and a password? Specifically, these security questions are exactly identical to a password that is stored in the clear (no hash, no salt) and is intended to be communicated to humans, and for which an attacker only has to guess one out of 4 correctly?

We know that this is bad practice for passwords. Why do we tolerate it for "security questions"?

Re:Simple solution

[KhabaLox]

It might not occur to your proverbial grandma that people can track down her mother's name.

That's because, as everyone knows, people from Proverbia are idiots.

Re:Simple solution

[Cinder6]

Hell I did it with Blizzard for what, $30 and I got a plush toy.

This has always bothered me. My Blizzard and SWTOR accounts have much stronger authentication (from a user perspective; not sure about the underlying technical security measures) schemes than my bank account. My bank only allows a maximum of 14 characters in a password and severely limits you on what special characters you can use. They also have no form of secondary authentication, such as Blizzard's Battle.net Authenticator. Finally, their security questions are a joke, all along the lines of those mentioned in TFS--"What is your mother's maiden name" and the like.

My solution to bad security questions? Answer unasked questions. What's your mother's maiden name? Pepperoni pizza. What street did you live on? Empire State Building. Then use different answers for different sites, like you should your passwords. Just be sure you can keep track of them--either an encrypted file or a password manager program.

Re:Simple solution

[Cinder6]

A good idea, but I'd hate having to remember--exactly--a 5,000 word essay in case I need to reset my password.

Re:Simple solution

[glodime]

She is you.

Re:Simple solution

[ultranova]

For phone stuff I set security questions like "Would you like to have dinner some time?" or "Wanna have sex when I get off?" and call to tease the cute customer service girl.

Nothing's funnier than harassing a minimum wage worker who has no choice but to take your shit or be fired, eh?

Let me guess: you're a CEO?

Re:Simple solution

[Bert64]

I do similar, but with a wildcard subdomain so user@something.mydomain.com, the reasons for this are:

1, spammers will try to brute force common email account names once they get a domain to target
2, i can override the wildcard by creating specific mx records for a given hostname, and thus lose the spam without my mailserver having to process it at all, usually i redirect it to the mx records of the server that sold me out.

Re:Simple solution

[jmerlin]

What scares me the most, I think, is that several of the banks I've used have required ridiculously short passwords and relied heavily on these "security questions" as a second tier of authentication (as if that's more important than 64+ more bits of strength in the password). So you have to pick a password that's between 4 and 8 characters or some nonsense and answer some questions like "mother's maiden name" and "name of first employer" etc.

What we need is some kind of authenticator or something. If you can't trust me to use a 24+ character password or provide me with a more secure means to log-in, I can't trust you to hold my money. It's that simple. Keyloggers still win against complex passwords. Blizzard solved the problem by using symmetric cryptographic protocols so a device that's highly unlikely to be compromised is the source of part of the key (a keychain or a smartphone app). Why can't banks do the same? What a damn shame.

Re:Simple solution

[Culture20]

And what happens if you loose the salt?

It dumps out into a big pile on my friend's plate. Hilarious.

Re:Simple solution

[uniquename72]

And as long as you always answer 42, or 416 what is the problem with that?

This is pretty much what I do. I have a password that changes based on the question, but isn't actually the answer to the question.

BYO

[wstrucke]

I find the security questions I like best are the ones I can make up myself. I typically use nonsense phrases that only I know the answer to. Unfortunately most sites would prefer you pick one of several 'standard' questions like the examples OP provided.

Re:BYO

[nedlohs]

Making them completely pointless, since you'd only need them if you lost the password which would presumably also be in the password manager.

Re:BYO

[HawkinsD]

My favorite make-up-your-own pair, which a CSR at a bank was once forced to read to me over the phone:

Q: "You're not going out dressed like that are you?"

A: "You can't tell me what to do! You're not my real father!"

Re:BYO

[X0563511]

I'd rather just be able to disable the questions entirely, relying on a good password and if that is lost/whatever, account specific information being verified by a human on the phone.

My problems with these "secret questions" are:
1. They are obviously stored cleartext
2. They can be used to "substitute" for your non-cleartext password
3. Because 1+2=3, if someone breaks in and grabs a dump of the table, they now effectively have your account. These "insecurity questions" are more of a liability if you are not one to just lose passwords. Crutch for the stupid, barrier for the secure.

Re:BYO

[captaindomon]

From Bruce Schneier: Q: Do you know why I think you're so sexy? A: Probably because you're totally in love with me. Q: Need any weed? Grass? Kind bud? Shrooms? A: No thanks hippie, I'd just like to do some banking. Q: The Penis shoots Seeds, and makes new Life to poison the Earth with a plague of men. A: Go forth, and kill. Zardoz has spoken. Q: What the hell is your fucking problem, sir? A: This is completely inappropriate and I'd like to speak to your supervisor. Q: I've been embezzling hundreds of thousands of dollars from my employer, and I don't care who knows it. A: It's a good thing they're recording this call, because I'm going to have to report you. Q: Are you really who you say you are? A: No, I am a Russian identity thief.

That's Not Possible

[MightyMartian]

I'm sorry. Apple cannot make mistakes anymore. Clearly this is just anti-Apple-types trying to give the greatest, most wonderful, most lauded, most glorious company that has ever or will ever exist.

I'm now turning my iPod up to 11 to drown out the filthy lies of the naysayers. Jobs be praised.

Re:That's Not Possible

[nazsco]

IPads only goes up to 10. 11 would be too complicated, like a second mouse button.

What is Your Favourite Colour?

[Jeremiah Cornelius]

What is your quest?

What is the air-speed velocity of a coconut-laden swallow?

Who answers security questions honestly?

[BMOC]

The best use of security question is to answer them dishonestly/humorously with responses you will remember, or can write down.

Favorite movie? Gigli
First Car? Moon Rover
Mother In Laws Name? Dead
etc..etc..

Re:Who answers security questions honestly?

[imagined.by]

I usually just generate additional passwords and save them in KeePass.

Don't Give the Real Answer

[mikestew]

Google me all you want, the real answer to "mother's maiden name" for me is "{ah23#>K&Ep", which I store in 1Password.

Of course, that does no good if Apple simply ignores the security questions.

Use the First Girlfriend question

[danbuter]

Jokes on them! I've never had a girlfriend!

Mother's maiden name

[AnalogDiehard]

I use my mother's mother's mother's maiden name. Unless you know my family genealogy, it's a lot harder to get that from Google.

I had to resort to adding layers of generations when my (now ex) wife attempted to open credit cards behind my back.

Security questions: FAIL

[macraig]

Many security questions are a failure from the start due to poor selection. While one would expect that a security question would challenge an objective fact, many of them don't. Instead they challenge subjective facts, most often "favorite" things. What happens to a person's answers when his mental list of favorite things has changed? I've encountered some instances where these "favorite" questions were so prevalent that there wasn't even one objective question as a choice. While it's true that "favorites" might be less susceptible to data mining than objective facts, the last thing security questions should ever do is create the possibility that the legitimate user might be locked out because he can't recall what his "favorite" was at the time of the account's creation. This is akin to the bad habit of using e-mail addresses as usernames. What's more, many of these choose very poor subjects that lead to potentially ambiguous answers; there have been many occasions when I couldn't decide the correct answer to a "favorite" question even at the time of creation, much less a year later.

It's not the questions

[gerardrj]

It's the answers. For the best security the answers should have nothing to do with the question, just like you see in all those old spy movies:

Q: What is your favorite color
A: walkaboutclock

Q: What was the name of the street you grew up on?
A: g!blix05

When only the account holder can possibly know the answers then there can be no social engineering to bypass the security.

None of this, of course, has any effect if policies and procedures at the vendor site allow for the questions to be bypassed. As I have posted elsewhere, we don't know the contents of the alleged call; the operator could have been threatened, blackmailed, bribed or even an accomplice.

Then make it simple... use an algorithm!

[gosand]

Use an algorithm.
Use real answers, but replace vowels with the letter Q. (for example)
Mother's maiden name: Smith => SmQth
First pet: Spot => SpQt

Just make up a general rule. This is what I do with my passwords. They are based on a rule that I can remember. Then you can apply that rule to any password.
Like switch the first and last letters. Smith = hmitS, Spot = tpoS. Or use numbers. Or a combination. It quickly looks like nonsense, but if you use a rule then you can apply it. Or change it. If you have to change a password, then switch from using Q to W, then E, then R, then T, etc.

You can even write down your rule in plain site. If I wrote down "flip Q" as a reminder, it would remind me to flip the first and last letters, then replace vowels with Q.

And I just came up with this one for this post. The one I actually used is based on something nobody could guess, and has been altered over the years so that I am the only one that knows it. And it works! I still remember an intern at my first job left to go back to school in 1994, and he told me his unix password in case I needed to get into his account. It was CIrpotb, (Clearly I remember picking on the boy,) from Pearl Jam's song Jeremy.

Re:mother's name

[TaoPhoenix]

How did the summary miss the chance to mention Facebook? Oh, they don't mention the F-word (!!) for once when it makes the Zuck look bad?

For lists of questions that don't include "design it yourself", Facebook is the Walmart of Secret Question Busters.

(Simulation)
"Yay, I feel special, I made a Facebook account! Let's tell the whole world who I am! I'm ______ ______, I born and raised up in Philly, shout out to all the Main Street peeps! My whole family is there in Philly. Let's Like Mom, and Mom's whole family! I named my cat after Susan Boyle's, Pebbles."

(Later, looks at security questions. "Doh!")