Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access.

As an example, Facebook uses this form: Facebook security question form

There isn't a question on that list that my closest friends don't know, and most of the answers can easily be found or are a matter of public record in many countries.

What value is there in providing fixed security questions?

Edit: The emphasis here is on having fixed questions rather than on a field where I can type in my own question which I'm sure nobody but me knows the answer to.

share|improve this question
    
Seems quite similar to a question I recently asked (that you incidentally provided a good answer to) ux.stackexchange.com/questions/13530/… –  JonW Nov 16 '11 at 11:05
    
@JonW: I'm not asking whether the hints themselves are useful. I'm asking about having fixed security questions. –  JohnGB Nov 16 '11 at 12:54
1  
Fortunately, I was born in the city of HPK'6HQ7%gQu. And my favorite pet's name was AUSuLder8i... –  John C Nov 16 '11 at 12:55
    
@JohnC: That is effectively the same as a second password then, so about the same benefit of not having a question in the first place. –  JohnGB Nov 16 '11 at 13:27
    
@JohnGB, yeah, that was my point :) I only use them for those sites that require you to have a security question (and since my passwords are safely stored in KeePass, I'm not too worried about forgetting them). –  John C Nov 16 '11 at 13:30

1 Answer 1

up vote 3 down vote accepted

People that make poor passwords and poor answers to security questions most likely will create poor security questions when forced to make a question.

The problem is, making a question that has an answer that is secret, unambiguous and memorable is fairly difficult. Which is why more and more sites are moving away from security questions for fallback authentication.

If you have to go with security questions it's probably best to provide a few questions but also allow for the advanced user to add their own write in question.

share|improve this answer
    
But why would a site like Facebook, which does a lot of testing, go for fixed questions only at all? I just don't see the benefit. –  JohnGB Nov 16 '11 at 13:29
3  
Has Facebook ever appeared to be super concerned about privacy or security? I just checked and these questions aren't even required. Are they being used at all? I figured that Facebook implemented multiple fallback authentication methods. –  JLWeber Nov 16 '11 at 13:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.