How Security Questions Can Get You in Trouble

Photo (cc) by b1gw1ght

Who’s your favorite superhero?

No matter which name you choose, bad guys have a decent shot at correctly guessing it due to the limited number of possible answers, according to a new study.

That fact illustrates a major problem with the security questions often used by online services to help users recover passwords: The answers to such questions are either memorable or secure, but rarely both.

The study — titled “Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google” — was recently presented at the 24th International World Wide Web Conference.

It was authored by four Google researchers and Joseph Bonneau, a researcher at Stanford University’s Applied Crypto Group and a technology fellow at the nonprofit Electronic Frontier Foundation.

The study is based on the use of security questions at Google. Google anti-abuse researcher Elie Bursztein and Google software engineer Ilan Caron, two of the report authors, explain in a Google’s Online Security Blog:

Despite the prevalence of security questions, their safety and effectiveness have rarely been studied in depth… We analyzed hundreds of millions of secret questions and answers that had been used for millions of account recovery claims at Google. We then worked to measure the likelihood that hackers could guess the answers.

The core problem with security questions, Bursztein and Caron write, is that they are rarely both secure and easy to remember.

Past studies cited by Google have found weaknesses in questions with:

  • Common answers. One study found that about 10 percent of answers could be guessed using a list of other answers provided by users in the same study.
  • Few plausible answers. Asking for your favorite superhero is one example.
  • Publicly available answers. Such answers are routinely listed publicly in online social-networking profiles or public records. For example, one study found that at least 30 percent of Texas residents’ mothers’ maiden names can be deduced from birth and marriage records.
  • Answers that can be obtained through email phishing. In one study, researchers used email phishing to learn answers to personal-knowledge questions from 92 percent of users.
  • Answers that acquaintances can easily guess. One laboratory study found that acquaintances could correctly guess 17 percent of answers correctly within less than a half-dozen attempts.

How can companies ask questions that are both more secure and easier for consumers to remember? The Google reseachers don’t offer a lot of hope.

They note that the most potentially secure questions are also those with the worst memorability — for example asking for your first-ever phone number.

They sum up their findings as follows:

We conclude that it appears next to impossible to find secret questions that are both secure and memorable. Secret questions continue to have some use when combined with other signals, but they should not be used alone and best practice should favor more reliable alternatives.

SMS-based password recovery and emailed-based recovery are examples of alternatives that are better than security questions, according to the researchers.

If you have trouble remembering your passwords, check out “5 Password Managers To Keep All Your Secrets Safe.”

Like this story? SHARE it on Facebook!

Disclosure: The information you read here is always objective. However, we sometimes receive compensation when you click links within our stories.

Read Next
7 Hobbies That Help You Live Longer
7 Hobbies That Help You Live Longer

Research shows some hobbies can add years — or even decades — to your life.

Prepare to Pay More for These 31 Drugs in 2021
Prepare to Pay More for These 31 Drugs in 2021

More than 700 prescription medications have seen price hikes so far this year. Here’s a look at the worst.

7 Ways to Shop at Costco Without a Membership
7 Ways to Shop at Costco Without a Membership

You don’t necessarily need to join to get in on the warehouse store’s savings.

The 3 Biggest Regrets of Retirees — and How to Avoid Them
The 3 Biggest Regrets of Retirees — and How to Avoid Them

Rescuing a retirement from regret starts with these steps well before it’s time to quit working.

7 Small Appliances You Don’t Need — and What to Use Instead
7 Small Appliances You Don’t Need — and What to Use Instead

Here’s how to get the job done without blowing money — or losing counter space.

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Most Popular
7 Kirkland Signature Items to Avoid at Costco
7 Kirkland Signature Items to Avoid at Costco

Even if it seems you save a bundle buying Costco’s Kirkland Signature brand products, they may not be the bargain they appear to be.

How to Buy Gas At Costco Without a Membership
How to Buy Gas At Costco Without a Membership

The warehouse club often has some of the cheapest gas in town. Here’s how you can get it as a nonmember.

10 Things to Stop Buying If You Want a Clutter-Free Home
10 Things to Stop Buying If You Want a Clutter-Free Home

If you like to keep things simple, avoid these purchases.

If You Find This Thrift Shopping, Buy It
If You Find This Thrift Shopping, Buy It

Vacuums from this brand can last a half-century, if not longer — and they’re hot on the resale market.

A Simple Way to Silence Robocalls Today
A Simple Way to Silence Robocalls Today

A few steps can keep your phone from ringing when a spammer calls.

This Company Makes the Best Tires in America
This Company Makes the Best Tires in America

Driver satisfaction with tires is at an all-time high, but one brand stands out.

This Health Issue Can Hint at Dementia Years in Advance
This Health Issue Can Hint at Dementia Years in Advance

One type of pain is especially associated with cognitive decline.

Can I Switch to Spousal Social Security Benefits When My Ex Dies?
Can I Switch to Spousal Social Security Benefits When My Ex Dies?

Knowing when to claim can help you maximize benefits.

Medicare Will Not Cover These 6 Medical Costs
Medicare Will Not Cover These 6 Medical Costs

Don’t let these health care expenses catch you off guard in retirement.

8 Things You Should Always Buy on Amazon
8 Things You Should Always Buy on Amazon

The giant retailer shines when it comes to these things, from basics to hard-to-find specialty goods.

5 Ways to Get Amazon Prime for Free
5 Ways to Get Amazon Prime for Free

Hesitant to drop $119 a year on an Amazon Prime membership? Here’s how to get it for free.

12 Deep Discounts Available on Amazon This Friday
12 Deep Discounts Available on Amazon This Friday

These items are steeply discounted — but the deals won’t last long.

5 Ways to Fill Your Pantry With Free Food
5 Ways to Fill Your Pantry With Free Food

Anyone can take advantage of these resources.

Beware This Hidden Ingredient in Rotisserie Chicken
Beware This Hidden Ingredient in Rotisserie Chicken

Something foul may lurk in those delicious, ready-to-eat birds.

3 Ways to Get Microsoft Office for Free
3 Ways to Get Microsoft Office for Free

With a little ingenuity, you can cut Office costs to zero.

6 Reasons You Should Stop Hiding Cash at Home
6 Reasons You Should Stop Hiding Cash at Home

Stashing money around the house is anything but harmless.

5 States With the Worst Health Care for Retirees
5 States With the Worst Health Care for Retirees

All of these states are located in the same region of the nation.

36 Things That Will Be Obsolete Soon
36 Things That Will Be Obsolete Soon

The writing is on the wall for dozens of things we have grown up with.

5 Products You Should Never Buy Generic
5 Products You Should Never Buy Generic

Sometimes the brand-name version is clearly superior.

View More Articles

View this page without ads

Help us produce more money-saving articles and videos by subscribing to a membership.

Get Started

Add a Comment

Our Policy: We welcome relevant and respectful comments in order to foster healthy and informative discussions. All other comments may be removed. Comments with links are automatically held for moderation.