Tell me more ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.
up vote 0 down vote favorite

I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting for someone who is setting up their company with an account. What security questions should be used in this instance or are the usual security questions fine.

share|improve this question
Don't use security questions if you can avoid it. Instead 2nd factor authentication 2FA is a good alternative. There's also a related question here: ux.stackexchange.com/questions/13530/… – greenforest Nov 19 '12 at 11:07
3  
The very fact that there are 'the usual security questions' in the first place to my mind makes the very idea less secure than just having a single email validation route. "Can't remember your email address? Just enter you mothers maiden name here to gain access instead!". – JonW♦ Nov 19 '12 at 11:24

1 Answer

up vote 1 down vote

Note that these kinds of questions are not very secure to begin with. Much of the information asked for can often be found using public resources like Facebook or genealogy data. There are well-documented cases of hacks based on these 'personal security question'. Personally, if forced to give answers to such questions, I just fill them with random data.

Do you really need such a password-restore service that uses these questions, or would it suffice to just have the just personally drop by a support desk (or call in) and have their password reset that way if and when needed?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.