3

We have an application where a user is required upon registration to set up three security questions and answers

When they login to the application, they must answer one of the questions after entering their username and password. Should they forget their password, 2 of the security questions are presented to be answered along with 2 items of data for them to enter (DOB, NI Number etc etc)

There was recently a scenario whereby a user forgot the answers to their security questions(!) and we had to re-register them from scratch which was quite cumbersome.

What is the correct UX for the scenario when a user forgets the answers to their security questions?

Improve this question
6
  • Hold on just one second. You are saying that upon successfully logging in to your app/website, you are always forcing the user to answer one of their security questions?
    – MonkeyZeus
    Dec 16, 2015 at 17:05
  • @MonkeyZeus - yes. Client's requirement/insistence!
    – Mike
    Dec 17, 2015 at 11:53
  • What type of app is this? Government, military, banking? I highly suggest talking with the client to figure out the root reason for asking a security question upon every single successful login. I would even go as far as saying that this "feature" is actually making your client's business look bad because, to me, this screams "our website and/or userbase is inept!".
    – MonkeyZeus
    Dec 17, 2015 at 13:59
  • 1
    @MonkeyZeus - could you possibly expand on why this screams "inept" please?
    – Mike
    Dec 17, 2015 at 14:14
  • 1
    From a website perspective: Please enter your username and password, you've entered it correctly but we don't trust you, just to make sure that this was not a fluke, please answer a security question. From a userbase perspective: We are having issues with users that cannot control their login credentials so they've blamed us when their account was compromised; our attempt to mitigate this is to add an additional step to the login process. I would be interested to know why your client is insisting this "feature".
    – MonkeyZeus
    Dec 17, 2015 at 14:46

4 Answers 4

Reset to default
2

The correct UX approach is to disregard the long overdue pattern of so called “security questions”. Users tend to forget them as well, especially in terms of capitalization of answers.

Instead you should provide a “forgotten password” link which sends a one-time link to the registered e-mail account where the user can provide new credentials.

enter image description here

Improve this answer
2
  • 1
    This answer does not answer OP's question.
    – MonkeyZeus
    Dec 17, 2015 at 13:48
  • @Benny Skogberg: I found your e-mail address via your GitHub profile. You might just have gotten a Github password reset email from me. Now (I guess) you are not super well known. People like Linus Torvalds, who are well known and who like to pick up fights online might have a couple of trolls who just like to annoy them. Imagine how annoying it would be to receive a password reset e-mail every few hours. A security question might save people from getting trolled.
    – Martin Thoma
    Jun 21, 2019 at 10:31
2

What is the correct UX for the scenario when a user forgets the answers to their security questions?

For your authentication mechanism (which, unless it's required by law, I see as paranoid) security question is equivalent and complementary to password.

mockup

download bmml source – Wireframes created with Balsamiq Mockups

In this case you may rephrase your question to "What is correct scenario when an user forget her password?".

Provide a password reset feature (see also What are great examples of a "forgot password" UX/UI pattern?), you do not need to re-register them, simply send then an e-mail with a link they can follow to insert a new password and three new security questions. Just remember that:

  • Link must be temporary and can be used only once.
  • Do not pre-fill new security questions with previous values.
  • Consider to require them to also enter user name and/or some other code you're sure they already have.
Improve this answer
0

I have forgotten my security questions on occasion or found that the website offered me questions which I hadn't selected (so I couldn't answer) so effectively the same as forgetting!

I thought to myself "Uh oh! What happens now?"

The website in question asked me to authenticate myself in a number of ways if I remember correctly and eventually reset my security questions as part of this process, probably due to my not knowing/remembering the answers at least I would hope that it's because I didn't know the answers as it would be very irritating to reset security questions if a user only forgot their password!

I cannot remember the exact authentication steps that got me back to safety but from the top of my head.

My UX scenario "likes" would be:

  1. An email "round trip" - "We have sent...check your email...click on the link..." etc
  2. Once they follow the link back I would offer, no force them to select new security questions...
  3. ...and possibly email the selected questions (but not the answers obviously) back to them so they could refer to them later if needed.
  4. after (if) this was implemented a reminder prompt could inform the user to check their "selected security questions" email sent to them on such and such a date!

Points 3 and 4 might be overkill though!

Improve this answer
0

You use security questions effectively as a second factor.

Two-Factor Authentication

Two-Factor authentication (2FA) is used to make it harder for attackers to get the credentials to login. You might have seen them in big services like Amazon Two-Step Verification or Google. It absolutely makes sense to use them if money is involved.

Please read the Multi-factor authentication wikipedia article for more details.

Security questions for 2FA

Better suited in another context, see 2-Factor Authentication vs Security Questions

Security questions for "forgot password"

Security questions make sense to avoid that your users get trolled by others through the "forgot password" function. Here is a small user story how that works:

Anna is on GitHub. Her username is her e-mail address, which she also uses to sign her commits and which she also has publicly in her profile.

Anna picks up a fight with Bob. Bob knows that Anna is on Github and wants to annoy her. So he triggers the "forgot password" function of GitHub every hour to distract Anna.

Let's say GitHub allowed Anna to set a security question (if she wants). Then the story would look like this:

Anna is on GitHub. Her username is her e-mail address, which she also uses to sign her commits and which she also has publicly in her profile. As she got some 'forgot password' emails before, she sets her security question to "What is the second name of the mother of my spouse?". A couple of people in her family know this, but it is not public information.

Bob knows that Anna is on Github and wants to annoy her. So he triggers the "forgot password" function. He gets asked "What is the second name of the mother of my spouse?". He googles for it, but cannot find this information. Anna is not bothered.

See also

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.