Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

Question

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a service to email them a secure link to reset their password? Also, what if they can't think of a memorable piece of information at the moment they're requested to enter it into a form? Surely the less required fields there are on a signup form the better.

The only time I can think that a memorable password question could be useful is for signing up for an actual email account; because you can't actually send a password reminder / reset to an address if that person can't actually access their email.

Is this an outdated concept, or does it provide genuine user benefits that I can't currently think of? (such as the giving the user the appearance of security - making them feel secure even if it actually provides no geniune security).

Answer 1

(Not really a UX question, imo.)

But here's what Bruce Schneier has to say about secret questions (which are bad for the same reasons hints are bad). Nuff said.

Answer 2

There is no good reason to use this for a service where you know a persons email address. Sometimes it is used in case someone looses access to their email address (changes jobs etc.), but even then I would question the choice.

Many programs require complicated to remember passwords under the misconception that they are more secure (like 3xzA@|\e), so people often forget them. This is usually done when you don't have a person's email address in the first place (usually for an email account). This causes many support calls, and in an effort to reduce those calls, companies added methods to bypass them.

But why have a secure password in the first place if you can bypass that with a less secure question? Surely the better option would be to allow someone to use a pass phrase instead of a password to secure the system in the first place.

I refer to this cartoon by XKCD which says it better than I ever could.

Answer 3

There's a few good resources on password usability.

Sitepoint has a great list of points when considering a password system, most importantly:

It can often seem like a good idea to allow users to include a hint to help them recall their password. However, this can be a little bit dangerous: users might simply enter their password (or a derivative of it) as the hint, or employ a hint that makes guessing their password all too easy. If you do want to use password hints, think about asking users for some additional information before displaying it, such as their ZIP code or date of birth.

Hints and Security questions are often too obvious (Password: Babies Hint: Babies) and if you have a set security question(s) a user might have no good answer, or the answers might be too obvious. Ask me my mother's maiden name? Everyone that knows me knows my answer! Ask my favorite Pizza place in Brooklyn? Um...what did I pick for that answer again?

Sitepoint also says this about password resets:

It’s a good idea to enable users to reset passwords themselves. That way, there’s no need for intervention on your part. Typically, this is done by sending a password reset email to the registered email account. The user clicks a link in the email, is directed to your site, and asked to set a new password.

It's hard to get a more pleasant experience than clicking a link to reset a password. No memorizing, no guessing, all I need is access to my email. This also avoids sending a password via email (which Sitepoint recommends against), which can be problematic if the user never changes that password and or if someone intercepts the email.

Perhaps beyond your scope, but a lot of people consider the whole system of password resets for common accounts to be a bad experience. Jonathan Duhig has a great blog post explaining how to cut out the "password" problem entirely; OpenIDs. Things like Facebook connect mean your user will never forget their password or username or hint or whatever--their security is simplified and you've torn down a number of barriers on sign up to boot. This is the ideal experience, if a user is willing to connect their OpenID to your site.

It's also important to note that asking for a password hint or security question is an extra step in signing up. Email password resets only affect users that need their passwords reset, asking questions on your sign up form affects all of them.

Answer 4

Dont bother with them. It really isn't asking a lot to get people to check their inbox.

Just have an email address submission field for forgotten password which fires off an email to the address if it is found on the system, sending a link with reset instructions. Do not feedback to the form if the email was not in the system - allows hackers/bots to determine if a specific email address is on the system.

Pretty standard. Wont piss people off and wont leave your system & customers accounts more vulnerable to hacking.

If people can't remember passwords, afraid that's not your problem, they set them. Just dont have crazy minimum password requirements - that pisses people off more than anything - leave it pretty open (eg: more than 5 characters, unless you're a bank). This way they're more likely to pick something memorable rather than have to make something up on the spot that they wont remember. If they use "password" and get hacked - again, their own fault.

If your product can do it, just use something like this: http://code.google.com/apis/identitytoolkit/v1/learnmore.html

Further simplifies the entire problem by using common login APIs

Answer 5

There is one scenario where a password question would help UX: it is not so easy to do an Denial of Service-Attack targeted to a particular user. If it is possible to reset a password without any "secret", a bot could reset your password every second - you would have no chance to log in.

In most applications, though, confidentiality & integrity is far more important than availability.