7

Many sites/services seem to make use of a security question as a way of accessing an account if you lose your password or email access.

As an example, Facebook uses this form: Facebook security question form

There isn't a question on that list that my closest friends don't know, and most of the answers can easily be found or are a matter of public record in many countries.

What value is there in providing fixed security questions?

Edit: The emphasis here is on having fixed questions rather than on a field where I can type in my own question which I'm sure nobody but me knows the answer to.

5
  • Seems quite similar to a question I recently asked (that you incidentally provided a good answer to) ux.stackexchange.com/questions/13530/…
    – JonW
    Nov 16, 2011 at 11:05
  • @JonW: I'm not asking whether the hints themselves are useful. I'm asking about having fixed security questions.
    – JohnGB
    Nov 16, 2011 at 12:54
  • 1
    Fortunately, I was born in the city of HPK'6HQ7%gQu. And my favorite pet's name was AUSuLder8i...
    – John C
    Nov 16, 2011 at 12:55
  • @JohnC: That is effectively the same as a second password then, so about the same benefit of not having a question in the first place.
    – JohnGB
    Nov 16, 2011 at 13:27
  • @JohnGB, yeah, that was my point :) I only use them for those sites that require you to have a security question (and since my passwords are safely stored in KeePass, I'm not too worried about forgetting them).
    – John C
    Nov 16, 2011 at 13:30

1 Answer 1

5

People that make poor passwords and poor answers to security questions most likely will create poor security questions when forced to make a question.

The problem is, making a question that has an answer that is secret, unambiguous and memorable is fairly difficult. Which is why more and more sites are moving away from security questions for fallback authentication.

If you have to go with security questions it's probably best to provide a few questions but also allow for the advanced user to add their own write in question.

2
  • But why would a site like Facebook, which does a lot of testing, go for fixed questions only at all? I just don't see the benefit.
    – JohnGB
    Nov 16, 2011 at 13:29
  • 4
    Has Facebook ever appeared to be super concerned about privacy or security? I just checked and these questions aren't even required. Are they being used at all? I figured that Facebook implemented multiple fallback authentication methods.
    – JLWeber
    Nov 16, 2011 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.