Working on a save quote feature for our new website, one of the security requirements is to ask a secret question and obtain a value from the user.
Does anyone have suggestions on the type of Security questions to ask?
Why not allow the user to enter their own security question?
The question itself doesn't matter, it's only there to jog the memory of the user. If you let the user type their own question, they would be more likely to remember the answer and you don't have to try and think of a lot of different questions to cover all situations a user might be in (ie. they never had a pet, don't know mother's maiden name etc).
The term "security questions" is a misnomer. Security questions create a potential hole or breach in security by providing ways for unauthorized users to gain access if the answer can be discovered. Hopefully, security experts will find better ways of retrieving forgotten passwords or verifying identification during login, but until then security questions will likely prevail.
Thus, security questions have both benefits and liabilities. Poor questions create security breaches and confusion and cost money in support calls. Good security questions can be useful in the current environment, but are not common.
However, there really are NO GOOD security questions; only fair or bad questions. "Good" gives the impression that these questions are acceptable and protect the user. The reality is, security questions present an opportunity for breach and even the best security questions are not good enough to screen out all attacks. There is a trade-off; self-service vs. security risks.
Social networking (Facebook, MySpace, Twitter, personal blogs, LinkedIn) are creating more of a risk for security questions. People are generously telling all about themselves, their history, likes, favorites, and more. It easier now to find information on people.
But to actually answer your question, that site provides a list that they say are better than others that meet the criteria of:
Good security questions have four common characteristics. The answer to a good security question:
Don't just use the standard questions like "mother's maiden name", "first pet's name", etc. They're widely used, and using them means you're forcing users to have the same security answers across different websites. That's a security hole, just like reusing passwords is.
I concur with Steve's recommendation of allowing users to make up their own questions. But if you really want to offer predefined questions:
Foreword: I really, really, really think you should go with Steve's answer.
Supposing that you choose to ignore that option, and are going to be asking a predefined list of questions, PLEASE make sure that you choose questions that cannot be easily resolved with a Google search of the person's name and the question.
Prior to Google existing, finding a mother's maiden name could be difficult. Now, it's pretty simple: person's name + white pages + mother's name + google search = mother's maiden name. In order to determine better questions, pick something complicated but easily remembered, that can't be simply searched. Some questions off the top of my head are:
The purpose behind these questions is to make the question and answer secret. Most of the questions that come predefined will be answerable with a simple Google search. Your job is therefore to make sure that the secret questions used by the user aren't easy for an unauthorized party (with reasonable search prowess) to answer.
Everything that everyone here has said I agree with. Making sure that the questions are not something that someone can easily Google, easy to guess, or unambiguous.
I believe having a create your own question is a good idea because someone can create a question that is not a common security question, however the downfall of this is you are not driving how secure the question is as well as stopping the user from creating something like this...
Question: "frog" Answer: "joe"
People may tend to get lazy and create extremely unambiguous questions that no one would ever remember. So I believe it would be important to have both a list of questions and the option to create your own question.
I think a pre-defined list is the way forward, I've solved this problem about security on my current project by asking the user to fill in three security questions. So a combo box (with all pre-difined questions - you can find good ones with a quick web search) and an input field underneath to fill in the answer.
Chances of guessing one are possible, chances of guessing all three highly unlikely.
Let's add what not to do, and why. For example the California Franchise Tax Board restricts selection to things like:
The answers to these questions can change over time. It might be a marginally OK choice for a site where user logs in often, and can see and adjust the answers. It's a bad choice for a site where the user logs in infrequently.
Also bad are questions asking for parts of other secure documents:
As a theft of that data from your firm could compromise the user's security on other sites.
You have alternatives, such as:
@Steve nailed the answer above. Can you think of your own question, with an answer that is super obscure? Probably yes. For example consider "where did Mary Jane hide my underwear that day in high school?". Be fuzzy in terms of an answer match, as these are human questions with human answers. Definitely accept any case (e.g. "The principal's Office") and maybe even partial string matches (e.g. "principal office").