Slashdot Log In
Study Shows "Secret Questions" Are Too Easily Guessed
Posted by
kdawson
on Tue May 19, 2009 04:10 AM
from the name-of-your-late-great-aunt's-fifth-parakeet dept.
from the name-of-your-late-great-aunt's-fifth-parakeet dept.
wjousts writes "Several high-profile break-ins have resulted from hackers guessing the answers to secret questions (the hijacking of Sarah Palin's Yahoo account was one). This week, research from Microsoft and Carnegie Mellon University, presented at the IEEE Symposium on Security and Privacy, will show how woefully insecure secret questions actually are. As reported in Technology Review: 'In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study's participants could guess the correct answers to the participant's secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.'" Schneier pointed out years ago how weird it is to have a password-recovery mechanism that is less secure than the password.
Related Stories
[+]
Politics: "Anonymous" Hacks Palin's Private Email 1733 comments
netbuzz writes "'Anonymous,' best known for its jousts with Scientology, has apparently hacked Sarah Palin's private Yahoo email account. Contents, including sample emails, an index, and family photos, have been posted by Wikileaks, which calls them evidence that the GOP vice presidential candidate has improperly used private email to shield government business from public scrutiny." Note that there is no easy way to tell if the material on Wikileaks is genuine or a hoax. Update by J : Genuine.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Don't use them (Score:5, Funny)
I don't think many people would guess the name of my first pet was OIYNTDttye7it867t&%&^%&^T(
Re: (Score:3, Insightful)
Re:Don't use them (Score:5, Insightful)
Parent
Re:Don't use them (Score:5, Informative)
Parent
Re:Don't use them (Score:4, Insightful)
You could always use the same answer for every question (regardless)
From your bank:
What was the name of your first pet? PASSPHRASE@bankdomain.com12345
From your e-mail:
What is your mother's middle name? PASSPHRASE@emaildomain.com12345
From your favorite blog:
What is your favorite color? PASSPHRASE@blogdomain.com12345
Not easily guessable without prior knowledge of the pattern, but easy enough for you to derive as needed. Now, the question would be whether or not they forward-only encrypt the answer and verify it much like a password or if it's stored in clear text that any numbnutz with DB access could poke around. Hopefully it's treated as secure as a password, but I could see a lot of places not treating it that securely (which is probably mentioned in the articles that I didn't read).
Parent
Re: (Score:3, Insightful)
While you may not be able to disable it, nothings stops you from having your mother's maiden name generated by apg.
Re:Don't use them (Score:4, Interesting)
It can be used sensibly. You can come up with a paragraph in a book (I have one), use the first letters, use the sentences up to the last one as the question and the last sentence as the answer.
Not foolproof, but generally good enough. At least when the system allows you to ask your own question.
Parent
Re: (Score:3, Funny)
itbGcthate
Please tell me the answer.
Re:Don't use them (Score:5, Informative)
That's the Bible, Genesis 1:1.
Parent
Re:Don't use them (Score:4, Insightful)
Also, neither would you. Hence, disabling this whole huge security hole.
Fixed it for you. If you look at a security as a bunch of security components put together either in line or in parallel, you'll realise that when you put in parallel something somewhat secure like a password and something not very secure like asking a question, then the system is only as secure as the weaker of the two securities. You don't need to know much about someone to know or guess where they were born or what their favourite TV show it, I mean that's the kind of information people put on their Facebook profile for the whole world to see to begin with.
Parent
Re: (Score:3, Insightful)
While this is mostly true it ignore the fact that someone will notice a password change next time they log on.
So they've noticed a breach post facto when anything the hacker wanted to do was already done. Like I dunno, send a bunch of bad things in your name, steal your sensitive data and so on. Yeah, knowing they might have done this really helps preventing it from happening.
Re:Don't use them (Score:5, Insightful)
Hence, rendering the whole facility useless, and causing you extra inconvenience.
Disabling an insecure security feature is not an inconvenience.
Parent
Re: (Score:3, Funny)
Being forced to enter "Ajkdua9uMNDiau9dfuJdjA(D82*27UAd89Z&DADAUIdjk" as your pet's name is certainly an inconvenience. At many sites you must actually enter it twice.
Re:Don't use them (Score:4, Funny)
Think how the dog feels, running to his bowl for food every time the fax machine starts a handshake.
Parent
Re: (Score:3, Insightful)
Sensible man. Now as long as he keeps that piece of paper secure (by keeping it in his wallet with his driver's license, perhaps) his account is secure. Until the Web site is cracked.
Re:Don't use them (Score:5, Interesting)
Some services let you choose the question as well as the answer. In that case, I always set the question to "What is my password?"
Parent
Re:Don't use them (Score:5, Interesting)
I bet it stores the answers as plain text instead of hashing it like your pass. You're probably basically giving the support guys your password, hope you don't use it elsewhere ... but no, of course no one would make a system that retarded
Parent
Re: (Score:3, Interesting)
You are assuming that the answer actually is his password.
Re:Don't use them (Score:5, Funny)
I always set the question to "What is my password?"
I would set mine to "What is t1f2l3g4 ?" with the answer being "Not my password!"
Parent
Re:Don't use them (Score:5, Insightful)
Not only that but when I have used them I've found them annoying as they're often case sensitive and it's easy to forget what you entered or how you entered it. What is your dog's name? Which dog? What is your date of birth? What date format?
They're just bad all round, often the questions you get to choose from either fall into the category of far too easily guessed/socially engineered such as where were you born which 90% of people you've ever met can tell from something like your accent or where you work and live if you never moved away or they fall into the category of being too ambiguous such that when it comes back to remembering how you entered it 3 tries will probably get you locked out.
Creating a list of questions that truly are secret and of which at least one is common to everyone is near impossible. You could start asking things like "Who at your workplace would you most like to sleep with" but I don't think most people would want to answer such intrusive questions!
Parent
Re:Don't use them (Score:4, Interesting)
I always sha those stupid questions with a related answer and some number: echo -n MyPet01|shasum -
Parent
Re: (Score:3, Funny)
I use the same password on my luggage!
Not bad if used with email (Score:5, Insightful)
Secret questions are only less secure than passwords if they tell you the password right away. But if they reset the password and email the new one to a pre-specified email account then just guessing the answer isn't enough; you'd have to have access to the victim's email account too.
This doesn't really work that well if the password is actually for someone's email account, though.
Re: (Score:3, Insightful)
So I was wondering. I forget my password to Site A, and go through a password recovery and answers a secret question only I know about, and then they send me a new password, or password recovery instructions, to my email.
This is where I get a bit confused. Why go though the entire Secret Question thing, if the system is going to send it to my email anyway?
Why not skip the secret question part, and just send me a email with instructions or new password right away?
Only thing it may protect against, is a stole
Re: (Score:3, Interesting)
Primarily, I believe that is useful for sites that reset the password when you request it. Some do that and send you a new password, instead of looking it up. This is mostly if they encrypted it and discarded the original password. That way some random person is less likely to unset your password unexpectedly.
My bank uses similar logic, for an authorized computer designation. They track the computer I'm logged in from, and if I change computers, I have to click to email (or text message) a secondary key for
Re:Not bad if used with email (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
I usually employ the "send and click link" method.
You request a password change, the system sends you an email with a link you need to visit, to confirm you did indeed request a password change. Only then does it generate a new, random, password and mails it to you.
No one can change your password, without your acceptance. No need for secret questions.
What did they really expect? (Score:3, Insightful)
The questions have to be so easy that the owner will -never- forget them... That means they pretty much have to be a defining characteristic in a person's life.
Favorite color, birth city, mother's maiden name, location of first job, favorite pet, etc etc.
While my friends couldn't name a couple of those, it'd be stupidly easy for them to get those answers from me in a normal conversation. Even strangers, around friends, have a good chance at it.
Also, my bank takes this a step further... Sometimes when you log in, it asks you one of the security questions after you put in the name and password. I've never felt this made much sense, but oh well.
Secret Question are easier than the password (Score:5, Interesting)
What is the surprise? They don't have to follow the same rules as passwords (letters and at least 1 number, etc) that many sites enforce. Plus, if they don't let you make your own question, they pretty much stick to the same stupid, generic 5-8 questions they all have.
If someone was really wanted to go on a phishing expedition, they would open a site that requires registration, security questions, and all that, and then try the information on the webmail of the people who just registered. Probably would work phenomally as well.
If websites wanted to be truly secure, they would ask for a mailing address or at least a phone number to confirm resetting things (thinking of financial accounts, not stupid forums). They confirm the same inane, easily duplicable facts in real life, but at least they have to reach you at a confirmed safe location.
I agree (Score:5, Funny)
Secret questions are way to easily guessed. They should just stick to the most reliable password of all, mother's maiden name. Who the hell else would know that?
Re:I agree (Score:5, Insightful)
Every other web site that you visited that asked that question.
Parent
Spot on (Score:5, Interesting)
Shame I just used my mod points. There are plenty of cultures in which women don't change their names when they marry, and even in those where they do they tend not to change them unless they marry, which is becoming less common. Fortunately banks are starting to wake up, and maybe in a decade they'll all have semi-sensible account security.
Parent
encrypted password file (Score:4, Insightful)
I just keep a gpg-encrypted file with all my passwords. When sites ask these retarded questions, I just generate a long random alphanumeric string (using a little perl script), and save it in my gpg file. This file is heavily backed up. I cannot imagine a scenario where I would lose a password, or the answers to "secret questions".
The only time I've had a problem is with stupid websites that require registration (and I don't care about, so didn't write down the gibberish I wrote in their registration form) and some time later I decided to come back to that stupid site.
Re:encrypted password file (Score:5, Insightful)
Well, that's clever, everyone should do that. I'll have to teach my grandmother to write perl scripts, then remember what she called it, where she stored it, and how to run it everytime she is asked one of these retarded questions. Oh, and also how to save the output to her gpg file after remembering what her gpg file was called and where she stored it and what its password is.
If you (presumably) guard your passwords carefully (in this same gpg file?), why do you even bother saving the answer to the "secret question"? Just type a bunch of random keyboard characters (bang hard, using the opportunity to release the pent-up frustration), don't save it, and be done with it. Isn't that faster than going through the perl script rigamarole?
For most things - various user forums, etc. - I don't give a damn about all this password/secret question paranoia. If they crack it, so what? I haven't changed my slashdot password since day one, its easy for me to remember, and if someone cracks it and "steals" my "identity" here, well, I would probably find it amusing.
There are a relatively small number of things, such as bank accounts and trusted access to other people's networks (and yeah, my servers' roots) whose passwords I protect very carefully. Almost none of those things involve extra secret questions in case I forget the password, or if they do I've give a gibberish answer I don't save.
(OK, I have a CISSP cert, and those hyperparanoia-filled meetings I have to go to to keep it up sometimes make me want to scream).
Parent
Why don't... (Score:5, Interesting)
Then again, if they truly know you, then maybe they'd guess you'd be this paranoid
My Qs (Score:4, Funny)
Q What is the highest prime number?
Q In 60 characters, prove Goldbach's conjecture
Q How many palindromic primes are there in base-10?
Q What is the lowest Sierpinski numer?
Q Solve the Happy Ending problem for arbitrary n
Q Prove or disprove that the Euler-Mascheroni constant is irrational in 60 chars.
Crack my account and I'll use your idea ^^
I use a physical book. (Score:5, Interesting)
If I'm allowed to choose the question, I use the time-tested method that was used in 80s games, which is "word in page x, line x, x-th word". If I'm not, it's usually a "pet" or "mother's name" question and I use the characters names or animals in the book.
I also use the book as a source for passwords for the many accounts I have everywhere on the internet. I spell out the login name in the book (say "Mylogin") by looking for the first word starting with "M", then the next word with "y", then the nex word with "l", etc... until I find a word that starts with "n", use the very next word that's 8 characters or more, append the line number, and that's my password.
I usually remember most passwords I use all the time, but for the accounts I seldom use, the book title is the only thing I need to remember to recover my passwords. Given the size of my library and the fact that the book is a huge, boring French novel, tough luck even for a burglar to find it.
Re: (Score:3, Funny)
Even better: check out the definition of paranoid [slashdot.org] I just found on Slashdot!
bogus answers (Score:3, Insightful)
The problem comes with those idiot services that try to be too clever by half, and ask a battery of questions ("what was the name of your first grade teacher" "what was your first dog's name") and other such worthless trivia. These fields are required, and cannot be skipped. One day, the site decides to be clever again (I can picture some nerd furiously beating off as he thinks about his great idea) and asks me what's my favorite color when I log in. I mean, if I forget my password, that's my problem. But using these personal questions as some sort of CAPTCHA or user verification is just stupid.
Yesterday wants its news back (Score:3, Informative)
I dimly remember I saw something like this on /. before...
It's a no brainer. Or at least it should be. Most of those "secret" questions draw from a limited set of possible answers. Worse, ALL those answers will be found in a dictionary. Because they invariably ask for (*drumroll*) a real, usually English, word.
Now, what do we tell people, what did we tell them for ages? DO NOT use words that can be found in a dictionary. Yet for the "secret answer" (which is in almost all cases as good as the real password) we ask for a word that can be found in one.
Is it me or is this like, you know, STUPID?
There is no "secure" word. Not even your pet's name. My first pet was called ;drop table *;, btw. Yeah, I'm such a geek... sorry 'bout your database, btw.
Study... (Score:3, Funny)
Is this the study that was conducted by 4chan during the election? Where they found that 100% of Sarah Palins have easily guessed Yahoo mail security questions?
Ok, stop the smart ass solutions (Score:5, Insightful)
And before that... (Score:3, Insightful)
Schneier pointed out years ago how weird it is to have a password-recovery mechanism that is less secure than the password.
Trump that: E.E. 'Doc' Smith pointed out sometime in the 1930s that what the world really, really needed was a foolproof way of establishing someone's identity. Unfortunately, his solution was to have some omnipotent aliens come up with a magic identity bracelet, which isn't particularly helpful.
That's the real problem - these dumb-ass methods of establishing identities come about because there is no good solution on offer to let a service provider check that you are who you say you are - and no way do we trust our wonderfully tech-savvy governments or industries to set up and run one.
delimited passwords (Score:3, Interesting)
i, too, have always deplored the secret question. so many sites force you to use them but they are really just insecure back doors into your account.
my solution? for years i've been treating passwords and secret questions as two fields each, delimited by a non-alphanumeric. for example: say my mother's maiden name is "harris", i and i'm entering it as a secret answer on amazon.com. i would answer "amazon*harris". for passwords, i have a standard password, for example, "ninjasinmypants". at amazon.com, my password would be "amazon*ninjasinmypants". that way my password is different from site to site, but still easy to remember.
add some password common-sense, e.g. not using dictionary words, and you end up with pretty strong passwords that are easy to remember.
Re:Breaking news (Score:4, Funny)
You just gave it all away! Now we know that the question was "what is your sexual orientation" ...
Parent
Re:random answers (Score:4, Funny)
#0099CC
Parent
Re: (Score:3, Funny)
#0099CC
Great. Now I have to change the combination on my briefcase...
Re: (Score:3, Insightful)
Re:You do have secrets... (Score:5, Funny)
Yes, but "Where are the bodies buried?" [xkcd.com] isn't really the question you want to choose for password recovery.
Parent
Re:Its a flawed concept (Score:4, Informative)
Parent