I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting for someone who is setting up their company with an account. What security questions should be used in this instance or are the usual security questions fine.

  • Don't use security questions if you can avoid it. Instead 2nd factor authentication 2FA is a good alternative. There's also a related question here: ux.stackexchange.com/questions/13530/… Nov 19, 2012 at 11:07
  • 5
    The very fact that there are 'the usual security questions' in the first place to my mind makes the very idea less secure than just having a single email validation route. "Can't remember your email address? Just enter you mothers maiden name here to gain access instead!".
    – JonW
    Nov 19, 2012 at 11:24

1 Answer 1


Note that these kinds of questions are not very secure to begin with. Much of the information asked for can often be found using public resources like Facebook or genealogy data. There are well-documented cases of hacks based on these 'personal security question'. Personally, if forced to give answers to such questions, I just fill them with random data.

Do you really need such a password-restore service that uses these questions, or would it suffice to just have the just personally drop by a support desk (or call in) and have their password reset that way if and when needed?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.