Comments on: But, what if?

By: Chris Pallé

Chris Pallé — Wed, 07 Jan 2009 22:00:13 +0000

@Jarod odds are, they won’t all be bad. There’s also the “make up your own question” option as Naomi suggested.

@andrew that’s a fail on the recovery side. Generally, we can’t prompt users to answer a security question without a username. The username is associated with the supplied questions…. and case-sensitive? ummm, yeah.

@mike a suitable work around? There are a few alternatives. We could get really crazy and have a voice-detection application that when establishing the account, requires a recorder that accepts the answer to the question that you’ve written out. Then a voice-matching application for recovery. Most computers have mics nowadays… I’m just sayin, if it’s _that_ important and they have the technical wherewithal, this could be a good way to go.

By: Mike

Mike — Wed, 07 Jan 2009 05:48:03 +0000

Agreed, and I find some questions annoying because of the assumptions made (what if you’re single and don’t have a spouse??). But as much as I loathe them, what would be a suitable workaround?

By: Naomi

Naomi — Sun, 28 Dec 2008 23:04:43 +0000

I second what everyone else said – I think it’s pretty much the most insecure security measure ever invented. Any member of my family would know any detail of my childhood or my parents such as pets’ names or maiden names or schools. Any of my childhood friends, too! I actually prefer the write-your-own for that reason, but only because I write bloody good ones. Even so, it is hard to think of something that NOBODY else knows. My partner knows a lot about my life too – and what if we break up and he decides to hack my accounts? Yeah, security question haz noes security …

By: Greg

Greg — Fri, 26 Dec 2008 03:09:41 +0000

I especially like it when sites let me choose my own security question. I like my question to be 'What are you wearing?' http://comedians.comedycentral.com/eugene-mirman/videos/eugene-mirman---security-question

By: Janet V

Janet V — Tue, 23 Dec 2008 16:58:49 +0000

My favorite was an early instance of the Vanguard site. They had several standard questions I could answer. I figured that I would use “Who was the best man at your wedding?”. Easy – Dick was the best man at our wedding.

When I typed in Dick, the system came back with an error message (I forget the exact wording) that those kinds of words weren’t allowed on their site!

By: Peter, Raleigh, NC

Peter, Raleigh, NC — Mon, 22 Dec 2008 16:05:31 +0000

“What is your father’s middle name?”

Answer: Jay

“Must be at least 4 letters long.”

I had no opportunity to tell the system that my father’s middle name is legally J-A-Y. I think I changed it to “Homer.”

Now that I use a stored password manager, these questions become less problematic for me.

By: Andrew

Andrew — Sat, 20 Dec 2008 18:52:24 +0000

Also @Chris, then the problem also becomes: which question did I choose? My worst example is EdFinancial, the student loan servicing site. They ask you to choose 3 security questions–each of the “what was your favorite restaurant in high school” type–from three separate lists. So the first problem becomes: what were the three questions I chose? Mother’s maiden name, favorite pet, model of first car? Or paternal grandfather’s nickname, first company you worked for, mother’s birth city? Then you have to actually get the answers right. Case-sensitive, sucka.

By: Jared Spool

Jared Spool — Sat, 20 Dec 2008 16:24:34 +0000

@Chris,

So, the moral to the story is, when designing forms with a security q, give multiple questions from which to choose via a drop-down or something.

Except that can just add insult to injury when all the questions are equally as bad.

By: Chris Pallé

Chris Pallé — Sat, 20 Dec 2008 13:41:45 +0000

So, the moral to the story is, when designing forms with a security q, give multiple questions from which to choose via a drop-down or something.

By: Ed Everett

Ed Everett — Sat, 20 Dec 2008 12:04:55 +0000

Well, what’s worse is to allow people to create their own security question. A certain application dealing with personal information I’ve worked briefly on does this.

People created questions that allowed access to their information like:

“Username?”

“1 + 1 = ?”

“1234″ (answer being “5678″)

By: Rahel Bailie

Rahel Bailie — Sat, 20 Dec 2008 08:29:50 +0000

I have those same problems when filling out security questions, usually because my life isn’t as boring, er, predictable as the question writers assume. I can’t begin to tell you how many times I’ve locked myself out of some account or other because I forget which of my first dogs’ names used (parents ran a dog kennel), or whether I counted my grandmother’s dog (because we lived with them until I was 2).

Like anything else, I found a workaround (thanks to a banking customer service person who obviously had enough to letting people back into their accounts). Pick all questions that are obviously unanswerable, then answer all three of them with a single secure password. If you’re not married, choose the question “who was your best man”, then answer fcUk0ft (for example). Should I have to do this? No. But it’s actually safer than answering correctly, because anyone with half a brain can find out where I was born and my birth date, for example.

By: kirabug’s idea files » Blog Archive » But, what if?

kirabug’s idea files » Blog Archive » But, what if? — Sat, 20 Dec 2008 05:05:27 +0000

[...] recent UIE Brain Sparks sums it up nicely. Bonus is comment #10, with the security questions we’d like to [...]

By: Hung Runningbear

Hung Runningbear — Sat, 20 Dec 2008 04:56:39 +0000

Security questions we’d like to see:

What was the name of the person who first broke your heart?

In what year did you finally accept that you were a passive-aggressive emotionally abusive control freak and that the breakup of your first marriage was in fact your fault?

For what offense were you first taken into custody?

What is your favorite single malt scotch?

What is your favorite expletive?

By: Develonizer › But, what if? (via Google Reader)

Develonizer › But, what if? (via Google Reader) — Sat, 20 Dec 2008 03:00:15 +0000

[...] hengst shared an item on Google Reader But, what if? 1 hour ago – Comment – Like This was written by benh. Posted on Friday, December 19, 2008, [...]

By: Cathy

Cathy — Sat, 20 Dec 2008 02:48:38 +0000

Anyone who keeps any sort of personal blog is vulnerable to these kinds of “security” questions. I’m liable to have publicly disclosed many of the answers somewhere along the line, and it’s too hard to remember a lie.

By: Char James-Tanny

Char James-Tanny — Sat, 20 Dec 2008 02:38:31 +0000

I caught the “(Not case sensitive)” part, too…thought it was funny.

And my husband and I met on the Internet What city should I enter? His at the time? Mine? The one where we live now?

Of course, my favorite question is “What is your mother’s maiden name?”

By: Patricio Moschcovich

Patricio Moschcovich — Sat, 20 Dec 2008 01:50:55 +0000

Gotta love the “(Not case sensitive)” part. The answer they expect is in YYYY format anyways.

By: Andrew Jaswa

Andrew Jaswa — Sat, 20 Dec 2008 01:32:13 +0000

Wow. Security questions always annoy me. I run into “What high school did you attend?” question a bit. I for one was home schooled all the way up to college and don’t have a “high school” so to speak. I tend to just enter “home” or something of the likes but it’s nothing I think about and can make it difficult if I choose “home” for one site and “home schooled” for another. It makes you wonder what is going on when they come up with the questions. Is it hard to come up with common questions that everyone can answer?

On that note I’ve seen sites that allow you to enter your own questions and then answer them. Still annoying but better then un-answerable questions.

By: Kyle Ridolfo

Kyle Ridolfo — Sat, 20 Dec 2008 01:27:44 +0000

The questions they’ve defined for you can also be depressing: they want the name of your dead grandparent, your long lost first pet, and the date you last had a bangin’ body.

By: erin malone

erin malone — Sat, 20 Dec 2008 01:26:42 +0000

I feel the same way about the “What is your hometown” question. I grew up in a military family and have no hometown – we moved every 2-3 years. Is this where I live now? Where I was born? Where my grandparents lived until they died or where my parents live now even though I have never lived there?

These questions are terrible over all because the edge cases create so many problems for a lot of people.

By: xian

xian — Sat, 20 Dec 2008 01:25:15 +0000

At least they didn’t ask you what year you “graduated high school.”

By: Abi Jones

Abi Jones — Sat, 20 Dec 2008 01:23:19 +0000

Wow, that’s potentially less answerable than questions like ‘What’s your favorite actor?’ or ‘What’s your favorite band?’. The company with the worst security questions: Virgin Mobile. They assume that a) you’re a teenage and b) you have unchanging tastes.