|
Are there any positives for security questions?? Well, I suppose secret questions are good for preventing brute force account recovery. You can't expect to beat security questions in a timely way with an automated attack. You would usually have to rely on manual search or social engineering, as pointed out by the article. But the real question is, why even allow account recovery via a publicly accessible web form in the first place? So, I definitely agree with the article, there has to be a change. You sure can beat security questions (at least in their current state), but it's probably much harder to get around something like email or SMS verification. Chase.com and cardmemberservices.com are good examples of SMS/email account verification done right, which I've used with great success, but both of these sites already had my personal phone number, so SMS verification just makes sense for them. I suppose SMS verification is probably the closest thing we've got to real user verification at the moment, am I silly to consider this the ideal venue for account recovery? The big issue, then, is it's definitely harder to get a user's phone number than to get their mother's maiden name, but skipping all that extra input and having a simple account recovery email should do the trick, shouldn't it? Most of the times you're already collecting user emails. Well, the biggest issue with email is that an email account can also be compromised. Perhaps getting big email companies like Gmail to remove security questions from their apps in lieu of SMS verification is the next step, while everyone else just relies on email-based account recovery (unless SMS is an option). If email security was more rock-solid, then email verification is all we need, right? |
Names? http://www.census.gov/genealogy/names is a good database for the US; 1,711 names will get you the top 50% of last names for "Mother's maiden name", questions. 59 male names and 138 female names also represents 50% of the population (Yes, we're pretty unoriginal). There are <100,000 first and last names in total which cover 90% of the population. (not combinations)
Birthdates? There are 365 days in a year, so 36,500 numbers will cover this one.
Last N digits of your drivers' license/social security number/credit card? There are 10^N such numbers. N is often 4, which is a measly 1,000 numbers.
Pretty measly stats.