How Security Questions Can Get You in Trouble

Photo (cc) by b1gw1ght

Who’s your favorite superhero?

No matter which name you choose, bad guys have a decent shot at correctly guessing it due to the limited number of possible answers, according to a new study.

That fact illustrates a major problem with the security questions often used by online services to help users recover passwords: The answers to such questions are either memorable or secure, but rarely both.

The study — titled “Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google” — was recently presented at the 24th International World Wide Web Conference.

It was authored by four Google researchers and Joseph Bonneau, a researcher at Stanford University’s Applied Crypto Group and a technology fellow at the nonprofit Electronic Frontier Foundation.

The study is based on the use of security questions at Google. Google anti-abuse researcher Elie Bursztein and Google software engineer Ilan Caron, two of the report authors, explain in a Google’s Online Security Blog:

Despite the prevalence of security questions, their safety and effectiveness have rarely been studied in depth… We analyzed hundreds of millions of secret questions and answers that had been used for millions of account recovery claims at Google. We then worked to measure the likelihood that hackers could guess the answers.

The core problem with security questions, Bursztein and Caron write, is that they are rarely both secure and easy to remember.

Past studies cited by Google have found weaknesses in questions with:

  • Common answers. One study found that about 10 percent of answers could be guessed using a list of other answers provided by users in the same study.
  • Few plausible answers. Asking for your favorite superhero is one example.
  • Publicly available answers. Such answers are routinely listed publicly in online social-networking profiles or public records. For example, one study found that at least 30 percent of Texas residents’ mothers’ maiden names can be deduced from birth and marriage records.
  • Answers that can be obtained through email phishing. In one study, researchers used email phishing to learn answers to personal-knowledge questions from 92 percent of users.
  • Answers that acquaintances can easily guess. One laboratory study found that acquaintances could correctly guess 17 percent of answers correctly within less than a half-dozen attempts.

How can companies ask questions that are both more secure and easier for consumers to remember? The Google reseachers don’t offer a lot of hope.

They note that the most potentially secure questions are also those with the worst memorability — for example asking for your first-ever phone number.

They sum up their findings as follows:

We conclude that it appears next to impossible to find secret questions that are both secure and memorable. Secret questions continue to have some use when combined with other signals, but they should not be used alone and best practice should favor more reliable alternatives.

SMS-based password recovery and emailed-based recovery are examples of alternatives that are better than security questions, according to the researchers.

If you have trouble remembering your passwords, check out “5 Password Managers To Keep All Your Secrets Safe.”

Like this story? SHARE it on Facebook!

Disclosure: The information you read here is always objective. However, we sometimes receive compensation when you click links within our stories.

Read Next
15 of the Most Outrageously Overpriced Products
15 of the Most Outrageously Overpriced Products

Retailers mark up products by hundreds of times their cost — but you don’t have to pay the premium.

6 Reasons Hiding Cash at Home Is a Terrible Idea
6 Reasons Hiding Cash at Home Is a Terrible Idea

Stashing cash around the house is anything but harmless.

These 12 Reusable Products Save You Money Over and Over
These 12 Reusable Products Save You Money Over and Over

Buy reusable versions of these household items, and you won’t have to spend another dime on them for years.

20 Generic Brands That Amazon Created
20 Generic Brands That Amazon Created

Amazon’s growing collection of private brands offers everything from toilet paper and coffee to motor oil and clothing.

12 Things Everyone Should Stop Buying This Year
12 Things Everyone Should Stop Buying This Year

These convenient household products come with hidden costs that you might not have considered.

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Most Popular
9 Things You’ll Never See at Costco Again
9 Things You’ll Never See at Costco Again

The warehouse store offers an enormous selection, but these products aren’t coming back.

11 Things Retirees Should Always Buy at Costco
11 Things Retirees Should Always Buy at Costco

This leader in bulk shopping is a great place to find discounts in the fixed-income years.

Over 50? The CDC Says You Need These 4 Vaccines
Over 50? The CDC Says You Need These 4 Vaccines

Fall is the time to schedule vaccines that can keep you healthy — and even save your life.

11 Senior Discounts for Anyone Age 55 or Older
11 Senior Discounts for Anyone Age 55 or Older

There is no need to wait until you’re 65 to take advantage of so-called “senior” discounts.

11 Household Items That Go Bad — or Become Dangerous
11 Household Items That Go Bad — or Become Dangerous

When you get the impulse to stockpile these everyday items, pay close attention to their expiration dates.

8 Things You Can Get for Free at Pharmacies
8 Things You Can Get for Free at Pharmacies

In this age of higher-priced drugs and complex health care systems, a trip to the pharmacy can spark worry. Freebies sure do help.

These Are the 4 Best Medicare Advantage Plans for 2020
These Are the 4 Best Medicare Advantage Plans for 2020

Medicare Advantage customers themselves rate these plans highest.

7 Ways to Boost Your Credit Score Fast
7 Ways to Boost Your Credit Score Fast

Your financial security might soon depend upon the strength of your credit score.

The 10 Most Commonly Stolen Vehicles in America
The 10 Most Commonly Stolen Vehicles in America

A new model parks atop the list of vehicles that thieves love to pilfer.

19 High-Paying Jobs You Can Get With a 2-Year Degree
19 High-Paying Jobs You Can Get With a 2-Year Degree

These jobs pay more than the typical job in the U.S. — and no bachelor’s degree is required.

5 Ways to Get Amazon Prime for Free
5 Ways to Get Amazon Prime for Free

Hesitant to drop $119 a year on an Amazon Prime membership? Here’s how to get it for free.

10 Reasons Why You Should Actually Retire at 62
10 Reasons Why You Should Actually Retire at 62

If you can, here are several good reasons to retire earlier than we’re told to.

3 Ways to Get Microsoft Office for Free
3 Ways to Get Microsoft Office for Free

With a little ingenuity, you can cut Office costs to zero.

26 States That Do Not Tax Social Security Income
26 States That Do Not Tax Social Security Income

These states won’t tax any of your Social Security income — and in some cases, other types of retirement income.

14 Things That Are ‘Free’ With Medicare
14 Things That Are ‘Free’ With Medicare

These services could save you money and help prevent costly health problems.

5 Keys to Making Your Car Last for 200,000 Miles
5 Keys to Making Your Car Last for 200,000 Miles

Pushing your car to 200,000 miles — and beyond — can save you piles of cash. Here’s how to get there.

5 Things That Make Life More Meaningful for Retirees
5 Things That Make Life More Meaningful for Retirees

Retirees agree: These are the things that give them purpose and fulfillment in their golden years.

10 Things You Should Never Do With Bleach
10 Things You Should Never Do With Bleach

Does the pandemic have you reaching for bleach more than ever before? Learn the ins and outs of using this powerful disinfectant.

15 Amazon Purchases That We Are Loving Right Now
15 Amazon Purchases That We Are Loving Right Now

These practical products make everyday life a little easier.

View More Articles

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Add a Comment

Our Policy: We welcome relevant and respectful comments in order to foster healthy and informative discussions. All other comments may be removed. Comments with links are automatically held for moderation.