My web app requires the users to provide secret questions and answers. The users can't pick a question from predefined ones, but have to write their own questions and (of course) answers.

For security reasons I then hash the answers before storing them in the data base. => this is when my problem occurs. I want to display the information (questions and answers) to the users on their profile pages, but - as the answers are hashed - I am not able to ever display them in plain text.

So the question is: how would you solve this for clarity and good usability?

My current approach is to display the questions and answers in an input field. If a user has already answered one of the questions, the answer input gets disabled and grayed out. The answer input contains no text (as it would only contain the "gibberish" hash string) => A user then has to make a change to the related question first, before he can edit the answer input.

UX problem secret answers

But I am not sure, whether this is good usability design and unambiguous?

  • 2
    There is surely an aspect of user experience to consider, but I think more importantly there are issues of security. I would urge you to ask a security-focused version of this question, or seek out existing questions, over at Information Security to get the full picture. – maxathousand Aug 20 '18 at 20:01
  • Beyond UI, you will need to make sure your comparison is tolerant enough to variations (e.g. capitalisation, punctuation, and possibly spelling), even though you can’t manipulate the stored version. That means at least cleaning up/canonicalising the input (with the same algorithm in both cases of course — you won’t be able to change it later), and possibly using something similar to soundex. Some answers are harder to keep consistent than you might imagine. – jcaron Aug 20 '18 at 21:49

I think you're doing the right thing from a security perspective but this statement would worry me:

I want to display the information (questions and answers) to the users on their profile pages, but - as the answers are hashed - I am not able to ever display them in plain text.

Can I ask why?

I would not expect a website to know what my password is, or display it back to me. By taking the correct approach and both hashing (and salting) the sensitive security information you have caused that problem, but for good reason!

The right thing to do here is NOT to show the user their security answers from the DB, because no one should know these apart from the user.

| improve this answer | |

there is a reason you should not ever show the security answers back to the user. those answers (and even questions) should be protected just like a password. if you forget your password, you have to use your security questions and answers instead of your password. Just look through best practices for security questions. Btw, if you really want to unhash, you could use a different encryption method that goes two way.

Still, for a user interface, you need to clearly show the difference between creating, viewing and editing. Since the answers are hashed, you no longer can edit them, you can only view if it's filled in y/n, or create a new one if its not filled in. So if you are just viewing, then you might show text label instead of the input box. a input box implies you can edit it. Or if you want them to create them new again, you would let the user know in the header with "set new answer" or something.

| improve this answer | |
  • "those answers (and even questions) should be protected just like a password" Being slightly pedantic, you cannot protect the questions as you would a password, since you need to show them in plain-text to the user. And while you wouldn't make them visible in someone's public profile, the questions aren't that sensitive. – TripeHound Sep 24 '18 at 13:53
  • there's one-way and two-way hashing. The password would be one-way and you can only check if the password you typed in is correct and you can never read what the password is.And you could protect the user information at rest so that you could not read the information unless you unhash it, for example you would only allow the user to see their own information. – user3749223 Oct 1 '18 at 14:27
  • That's encryption not (two-way) hashing. – TripeHound Oct 1 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.