How Security Questions Can Get You in Trouble

Photo (cc) by b1gw1ght

Who’s your favorite superhero?

No matter which name you choose, bad guys have a decent shot at correctly guessing it due to the limited number of possible answers, according to a new study.

That fact illustrates a major problem with the security questions often used by online services to help users recover passwords: The answers to such questions are either memorable or secure, but rarely both.

The study — titled “Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google” — was recently presented at the 24th International World Wide Web Conference.

It was authored by four Google researchers and Joseph Bonneau, a researcher at Stanford University’s Applied Crypto Group and a technology fellow at the nonprofit Electronic Frontier Foundation.

The study is based on the use of security questions at Google. Google anti-abuse researcher Elie Bursztein and Google software engineer Ilan Caron, two of the report authors, explain in a Google’s Online Security Blog:

Despite the prevalence of security questions, their safety and effectiveness have rarely been studied in depth… We analyzed hundreds of millions of secret questions and answers that had been used for millions of account recovery claims at Google. We then worked to measure the likelihood that hackers could guess the answers.

The core problem with security questions, Bursztein and Caron write, is that they are rarely both secure and easy to remember.

Past studies cited by Google have found weaknesses in questions with:

  • Common answers. One study found that about 10 percent of answers could be guessed using a list of other answers provided by users in the same study.
  • Few plausible answers. Asking for your favorite superhero is one example.
  • Publicly available answers. Such answers are routinely listed publicly in online social-networking profiles or public records. For example, one study found that at least 30 percent of Texas residents’ mothers’ maiden names can be deduced from birth and marriage records.
  • Answers that can be obtained through email phishing. In one study, researchers used email phishing to learn answers to personal-knowledge questions from 92 percent of users.
  • Answers that acquaintances can easily guess. One laboratory study found that acquaintances could correctly guess 17 percent of answers correctly within less than a half-dozen attempts.

How can companies ask questions that are both more secure and easier for consumers to remember? The Google reseachers don’t offer a lot of hope.

They note that the most potentially secure questions are also those with the worst memorability — for example asking for your first-ever phone number.

They sum up their findings as follows:

We conclude that it appears next to impossible to find secret questions that are both secure and memorable. Secret questions continue to have some use when combined with other signals, but they should not be used alone and best practice should favor more reliable alternatives.

SMS-based password recovery and emailed-based recovery are examples of alternatives that are better than security questions, according to the researchers.

If you have trouble remembering your passwords, check out “5 Password Managers To Keep All Your Secrets Safe.”

Like this story? SHARE it on Facebook!

Disclosure: The information you read here is always objective. However, we sometimes receive compensation when you click links within our stories.

Read Next
8 Ways to Snag Extra Savings at Walmart
8 Ways to Snag Extra Savings at Walmart

Are you aware of all these ways to boost your savings in Walmart stores and at Walmart.com?

7 Tricks to Cleaning Your Bathroom Faster
7 Tricks to Cleaning Your Bathroom Faster

These tips can get your bathroom sparkling with little time and no elbow grease.

13 Smart Tricks to Organize Every Room of Your Home
13 Smart Tricks to Organize Every Room of Your Home

Get your household organized with these brilliant and inexpensive tricks.

The 3 Biggest Regrets of Retirees — and How to Avoid Them
The 3 Biggest Regrets of Retirees — and How to Avoid Them

Rescuing a retirement from regret starts with these steps well before it’s time to quit working.

The 13 Worst Types of Tickets for Your Car Insurance Rate
The 13 Worst Types of Tickets for Your Car Insurance Rate

Some types of traffic violations can drive your car insurance rate dramatically higher.

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Most Popular
7 Kirkland Signature Items to Avoid at Costco
7 Kirkland Signature Items to Avoid at Costco

Even if it seems you save a bundle buying Costco’s Kirkland Signature brand products, they may not be the bargain they appear to be.

Am I Eligible for My Mother’s Social Security Benefit?
Am I Eligible for My Mother’s Social Security Benefit?

Can an adult daughter tap into her late mother’s benefit?

9 Things You’ll Never See at Costco Again
9 Things You’ll Never See at Costco Again

The warehouse store offers an enormous selection, but these products aren’t coming back.

3 Ways to Get Microsoft Office for Free
3 Ways to Get Microsoft Office for Free

With a little ingenuity, you can cut Office costs to zero.

This Surprise Factor Can Raise Your Risk of Dementia
This Surprise Factor Can Raise Your Risk of Dementia

Nearly half of U.S. residents may face this threat.

Organize Your Home With These 10 Thrift Store Finds
Organize Your Home With These 10 Thrift Store Finds

Resolve to be clutter-free in 2021 with these secondhand purchases.

This Gas Station Scam Is Victimizing More Drivers
This Gas Station Scam Is Victimizing More Drivers

For the second straight year, a growing number of Americans believe they’ve fallen prey to this scam.

11 Laws You Could Be Breaking Without Knowing It
11 Laws You Could Be Breaking Without Knowing It

Seriously? Fibbing about the weather is a crime? This and other little-known legal traps await the unwary.

11 Generic Products You Should Buy at Costco
11 Generic Products You Should Buy at Costco

Not all generics are worthwhile, but these are among the best from Costco’s Kirkland Signature brand.

These Are the 3 Best Used Cars You Can Buy
These Are the 3 Best Used Cars You Can Buy

These vehicles boast reliability, safety and long-lasting value.

13 Things Seniors Can Get for Free — or Almost Free
13 Things Seniors Can Get for Free — or Almost Free

There are many ways to get cheap or free services and goods after reaching a certain age.

6 Legal Documents Retirees Need — but Don’t Have
6 Legal Documents Retirees Need — but Don’t Have

Few retirees have all of these documents that are crucial to their golden years — especially during a pandemic.

8 Tips for Retiring Comfortably on Social Security Alone
8 Tips for Retiring Comfortably on Social Security Alone

It’s never too early to start learning how to live well while living on less.

Internet Providers Can’t Charge You for This Anymore
Internet Providers Can’t Charge You for This Anymore

Starting this month, your ISP no longer can bill you for this fee.

15 Painless Ways You Can Cut Costs in 2021
15 Painless Ways You Can Cut Costs in 2021

Follow these tips to save, so you’ll have money for things that really matter.

9 Small Expenses That Are Bleeding Your Budget Dry
9 Small Expenses That Are Bleeding Your Budget Dry

Keep more of future paychecks by eliminating these budget-busting unnecessary expenses.

Is This Treatable Condition Causing Your High Blood Pressure?
Is This Treatable Condition Causing Your High Blood Pressure?

Researchers say too many doctors are overlooking this potential source of hypertension.

11 Huge Retirement Costs That Are Often Overlooked
11 Huge Retirement Costs That Are Often Overlooked

Does your retirement budget account for all of these costs?

7 Bank Accounts With Extra Perks for Seniors
7 Bank Accounts With Extra Perks for Seniors

These accounts offer exclusive discounts and other perks — including interest — to older customers.

View More Articles

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Add a Comment

Our Policy: We welcome relevant and respectful comments in order to foster healthy and informative discussions. All other comments may be removed. Comments with links are automatically held for moderation.