I am developing a set of security questions for a corporate website. The usual security questions I come across are mothers birthplace, best childhood friend, ect. These questions don't seem fitting for someone who is setting up their company with an account. What security questions should be used in this instance or are the usual security questions fine.
2
-
Don't use security questions if you can avoid it. Instead 2nd factor authentication 2FA is a good alternative. There's also a related question here: ux.stackexchange.com/questions/13530/…– greenforestNov 19, 2012 at 11:07
-
5The very fact that there are 'the usual security questions' in the first place to my mind makes the very idea less secure than just having a single email validation route. "Can't remember your email address? Just enter you mothers maiden name here to gain access instead!".– JonW ♦Nov 19, 2012 at 11:24
Add a comment
|
1 Answer
Note that these kinds of questions are not very secure to begin with. Much of the information asked for can often be found using public resources like Facebook or genealogy data. There are well-documented cases of hacks based on these 'personal security question'. Personally, if forced to give answers to such questions, I just fill them with random data.
Do you really need such a password-restore service that uses these questions, or would it suffice to just have the just personally drop by a support desk (or call in) and have their password reset that way if and when needed?
