Security questions

2008 August 5

by thudfactor

I was setting up online access to a new bank account. So I had to pick and choose some answers to “security questions.” They used to ask you your mother’s maiden name, but not all moms have “maiden” names now (Elf doesn’t), and that’s easy to find out, so the questions have become more obscure. Here are a few the bank gave me to select from:

What is your favorite car?
What is the name of your favorite movie?
What was your most memorable gift as a child?
What is the name of your favorite novel?
What is your hobby?
If you could control your height, how tall would you be?
What is the last name of the funniest friend you know?
What is the most unusual job you’ve had?

Notice that none of these have a true or false answer. The answers to all of them depend pretty heavily on my mood. Except for #4 — I have stock answer for that one. I can’t use it, though, because Hitchhiker’s Guide to the Galaxy has an apostrophe in it, and I’m not allowed to use punctuation as my answer.

Surely there is a better mechanism.

Comments leave one →

2008 August 7

Mikey G permalink

The questions are generally just used when changing your account information - like password, address, phone number, etc, and However, your bank chose very poor questions, as you’ve observed. Well designed questions should be something that really only you would know, and have only one answer.

There are other mechanisms other than the knowledge questions, but I haven’t seen any of them used by companies when dealing with their external customers. The two big companies that offer these authentication systems, Entrust and RSA, offer a wide range of authentication techniques, but few are practical to use in the general population of their customers.

However, there is one really good mechanism that could be used. Specifically, one-time passwords sent to the consumer via email, SMS, or a phone call. So, if you want to change your password, you can’t do so until the bank calls, texts, or emails you a one-time password to do so. That can be used in conjunction with well designed knowledge-base questions as well.

2008 August 7

thudfactor permalink

I don’t know what this bank will do, but I have several accounts that use these security questions habitually — if they don’t recognize the computer, or if you are logging in from a different machine than usual, or if you’re calling to ask a basic question about the account. It’s pretty frustrating.

The worst was when one person — on the phone — asked me where my Social Security Card was issued. Since my parents got that for me, I had no clue. “Well,” the guy said, “it’s generally where you were born.”

“That’s easy,” I said, and told him. But I was wrong. The card had been issued someplace I had never been because the card was issued to a military dependent and was processed differently for whatever reason.

I know this because the guy asking me the questions eventually told me what the right answer was, which highlights another problem with the security questions…

Move aside, and let the man go through.

Security questions

Get Free Updates

Search

Recent Comments

Twitter

Archives

About Thudfactor