Security questions considered dangerous

re: Security questions considered dangerous

Alun Jones — Wed, 30 Jan 2008 02:16:05 GMT

Sounds like a company that needs a little security awareness training.

re: Security questions considered dangerous

Cat — Wed, 30 Jan 2008 01:51:26 GMT

Why don't you just walk over to the security office, show them your photo identity, and get them to reset your password?

Because the line of people getting their password reset over there is 4 hours long.

re: Security questions considered dangerous

Garry — Sun, 18 Nov 2007 00:41:07 GMT

Some questions pose more serious threats than others, and some can be quite difficult to decipher or crack. There's a list of good, fair, and poor questions at www.goodsecurityquestions.com along with guidelines to find the better questions.

Password reset challenge questions: More trouble than they are worth?

Paul Laudeman — Thu, 08 Jun 2006 01:39:53 GMT

Keith Brown states that password &ldquo;security questions are considered dangerous&rdquo; in the context...

re: Security questions considered dangerous

Alun Jones — Thu, 25 May 2006 03:39:50 GMT

The "walk over to the security office" is just an example. It could just as easily be "get two other people in your team to vouch for your identity", "get your manager to request the password to be reset", etc, etc - those are examples for an office environment. There are more creative ways to ask for verification of identity.
As to being extreme with the concerns, I guess it's going to depend on how many people are going to be inconvenienced by whatever scheme you choose. I never had a favourite sports team, but that's usually the choice I have to make when it's just one out of four questions, because I don't fit a number of other categories, or the answers to the remaining questions are known by too many people.

re: Security questions considered dangerous

Bucky — Wed, 24 May 2006 21:17:37 GMT

Q. Why don't you just walk over to the security office, show them your photo identity, and get them to reset your password?

A. Because that's way too far to walk.

Then again, people who know me might be able to guess that one.

First off, I agree with your overall intent, I just disagree with your examples. I think you are going a bit extreme with your concerns. There will always be systems where someone can't participate; Iris scanner/lose an eye, fingerprints/burns, etc. The solution is finding a good way to handle the majority while planning for the minority.