Secure Access

Examples of good security questions

[ferraristi]

Hi all,
I am hoping you guys might be able to help me with a small problem. I want to setup a secure members area for a website with usernames and passwords. I have noticed that sometimes when a user forgets a password they can get around the fact by answering some personal questions in order to verify their identities. I know it's not a good question but "what is your mother's maiden name" is a classic example.

Can anyone give me some examples of what would be considered better questions to ask?

Thanks in anticipation of your help

[JAB Creations]

The best way to go is to ask a questiont that you feel all humans can relate to but do not feel like sharing with the rest of the world or their friends. This will of course vary from human to human.

A good question for a nerd site would be, "what is your motherboards serial number?" hehe.

[ferraristi]

hmmnnn, I'm kind of hoping to come up with something which they don't need to take their PC's to bits to come up with an answer.

Thanks for the input though, I definitely take on board the first part

[sem4u]

Some questions:

What is you place of birth?
What is your favourite TV program / band etc.

[webg]

Stick with something that wouldn't have more than one answer.

Favorite band? Could change over time.
City you were born? With luck, there will only be one answer.

Other questions that shold only have one answer:
Name of first pet?
Age you first had sex?
Name of undergraduate college you graduated from?
Brand of first car?

[ferraristi]

Hi, again thanks for your input, but I am hoping to avoid questions to which the answers may change over time (favourite whatever it is) or things that can be easily researched such as date of birth, place of birth, name of first school etc.

One example I have come up with so far is, what is the title of a book you remember studying at school? I am finding it really difficult to come up with a lot of others though, so please keep the questions coming.

Thanks

[asquithea]

You can't really avoid using questions that will easily yield to research.

Halifax uses questions like:
- First school
- Town you were born in
- Mother's first name
- Father's first name

ING shies away from questions at all, and asks you for a memorable date. Personally, I struggle to come up with an answer for something like that -- you're not allowed to use your birthday, although well-known dates are permitted.

However, whilst the Halifax rotates these questions on its login page to improve security, most sites just need one security question. You could ask the user to specify a question of their own, but an alternative approach would simply be to allow them to write some text to give them a password hint.

So, for example, if I'd used the name of my previous pet cat as the password, I might supply a hint like "one-eyed kitty". That's still researchable, but realistically only immediate family might get that one.

[rocknbil]

I would have them compose their own security question at signup, with footnotes not to use any question that can be compromised, ie, mother's maiden name, etc.

Lots of ways for someone to screw that up, but still it is unique and puts the ball in their court.

[jessejump]

Doesn't the question trigger a email to the account owner and not immediate access to the account?
How can the email be intercepted?