0

I am currently in the process of re-designing a login process which uses security questions to verify the identity of users before they are successfully logged in, and also to allow them to reset their password. So, my question or rather questions are :

  • A- Is the use of security questions warranted at all given obvious flaws that they may have?
  • B- Would a separate secret password or passcode be more user-friendly while still secure?
  • C- Is there any research to support any of the options mentioned?
Improve this question
6
  • Unless you are a bank, what is wrong with a normal login process with password strength enforcement?
    – user31143
    Sep 10, 2014 at 14:59
  • Thats spot on. for login i don't think security questions are needed but when trying to reset password some form of additional security is needed and Iam thinking of using a secret password instead of existing security questions which i think are more a vulnarabilty rather than security!
    – Okavango
    Sep 10, 2014 at 15:04
  • Won't a secret password have the same problems as a normal password - i.e. the users will forget it?
    – Vince Bowdren
    Sep 12, 2014 at 8:59
  • The intended use of Security questions is outdated as it assumes that only the person logging in is aware of the answers. that could have been true before the use of social media (think linkedIn or Facebook). while a secret password has its flaw as you suggested, in my opinion it is still more secure than using questions. also, users are not likely to provide truthful answers to the questions in which case they might still forget the answer because in essence they are still providing another "password". So the idea is to design for real user behaviour i guess.
    – Okavango
    Sep 12, 2014 at 11:10
  • Related question from 2010
    – user1757436
    Oct 17, 2014 at 21:19

1 Answer 1

Reset to default
1

A: Probably not, unless there is something special about your userbase.

When the user wants to reset their password, you can send them an email containing a one-time-use link that will let them reset it. This is standard practice across most login-based sites on the Internet. Is there a reason your site requires additional security, or some reason your users are not able to use this method?

The Citrix article linked in the comment is pretty conclusive about the usability issues of security questions:

Though while there might be some optimism for more secure questions, usability remains a challenge. And while further experiments should be performed on larger, more diverse populations, and over longer periods of time, our initial results indeed indicate usability issues regarding the memorability and repeatability of answers. Novel solutions that ensure security and usability are needed in this area.

B: There are different options you have if you think emailing a one-time link is not secure enough.

  • A separate password is weird, and I haven't seen it before.
  • A separate passcode, such as a 4-digit PIN, is/has been used by some banking companies such as ING. This is often more memorable than a password, since users tend to choose a PIN they use elsewhere, but also less secure than a completely independent piece of knowledge or authentication token.
  • Some services, such as Backblaze or iCloud, instruct users to download a set of recovery keys, print them out, and store them somewhere safe in case they forget their password.

C: OWASP has a great set of articles on this. I would recommend their article on choosing and using security questions, as well as the site http://goodsecurityquestions.com/.

At the end of the day, any additional steps you put in front of your users' logging in or reset their password will make the site less usable. You need to decide if your users' security needs make the usability impact worth it.

Improve this answer
1
  • Well, the "separate password" method is used in mobile phones, with PIN and PUK. Not that I like it, but since it is send by paper, and cannot be changed, it's a good fallback (unless your users don't keep their papers :-)
    – virtualnobi
    Oct 22, 2014 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.