You know that thing that companies do when you set up an online account, asking you to name your favorite food and your high-school mascot as a way to recover your password later, or verify your identity if something sus is going on?
1/
1/
They're called "challenge questions" and they don't work.
That's the conclusion a group of Google security researchers and my EFF colleague Joseph Bonneau reached through a set of careful - and devastating - experiments.
static.googleusercontent.com/media/research…
2/
That's the conclusion a group of Google security researchers and my EFF colleague Joseph Bonneau reached through a set of careful - and devastating - experiments.
static.googleusercontent.com/media/research…
2/
Not only are the answers to these questions pretty easy for attackers to guess or research (your mother's maiden name is a matter of public record and your favorite food is "pizza"), but actual users really struggle to remember their answers.
3/
3/
Topline findings:
* "37% admitted to providing fake answers in an attempt to make them 'harder to guess' although on aggregate this behavior had the opposite effect"
* "40% of users were unable to recall their answers when needed."
4/
* "37% admitted to providing fake answers in an attempt to make them 'harder to guess' although on aggregate this behavior had the opposite effect"
* "40% of users were unable to recall their answers when needed."
4/
* "Questions that are potentially the most secure (e.g what is your firstphone number) are also the ones with the worst memorability."
* "It appears next to impossible to find secret questions that are both secure and memorable."
5/
* "It appears next to impossible to find secret questions that are both secure and memorable."
5/
I treat these questions as secondary passwords and use password generators to come up with strong, long passwords for them, managing them in a password manager (so much for memorable). Even this has an unexpected failure mode!
6/
6/
My small credit union's site requires you to come up with several of these questions at signup time: favorite movie, high school mascot, etc. You can answer from a list, or you can fill in our own. I did the latter, giving answers like "OWX~kMy!'(T;DkLwmBjrDs."
7/
7/
What I didn't know was that the challenge questions are presented as MULTIPLE CHOICE! So here's how it looks:
8/
8/
WHAT IS YOUR FAVORITE ANIMAL?
[ ] BIRD
[ ] FISH
[ ] TURTLE
[ ] DOG
[ ] PIG
[ ] RABBIT
[ ] SNAKE
[ ] OWX~kMy!'(T;DkLwmBjrDs
[ ] CAT
[ ] FOX
9/
[ ] BIRD
[ ] FISH
[ ] TURTLE
[ ] DOG
[ ] PIG
[ ] RABBIT
[ ] SNAKE
[ ] OWX~kMy!'(T;DkLwmBjrDs
[ ] CAT
[ ] FOX
9/
So much for my high-security, hard-to-guess alternative.
eof/
eof/
