Download as PDF, PPTX
Uploaded byJim Fenton
Security Questions Considered Harmful
The document critiques the effectiveness of security questions for account recovery, highlighting their common pitfalls such as complexity, shared answers, and predictability. It suggests that many users are unaware they can create nonsensical answers and emphasizes the need for better recovery methods. The author recommends choosing questions with deterministic answers and warns against relying on security questions for genuine security.
Security Questions Considered Harmful
- 1. “Security” Questions Considered Harmful Passwords2015 Las Vegas Jim Fenton @jimfenton
- 2.
- 3. Why do theydo this? It’s a cheaper way to do account recovery
- 4. Characteristics PASSWORD SECURITY ANSWER COMPLEXITY Complexityoften “enforced” by complex rules Often a word or name SECRECY Users are told to keep passwords secret Security answers available on Facebook, Ancestry…(OPM?) SHARING Attempts to train users not to share passwords between sites Security questions are common between sites STORAGE Should be salted and hashed Can’t salt/hash if need to do fuzzy matching
- 5. Best Practices? —OWASP, “Choosingand Using Security Questions Cheat Sheet” https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet “…make the Forgot Password solution as palatable as possible”
- 6. But, to befair… —OWASP
- 7. Opting out • Answeringsecurity questions is rarely optional • Many recommend answering the questions with jibberish • Many users don’t realize they can (or should) make up answers • Security questions often eliminate better methods for account recovery • We aren’t trying to solve this problem just for security professionals!
- 8. } } } 8 Context is important Mustbe truthful Must be truthful Make something up
- 9. Looking up theanswer What is your mother’s maiden name? What is your oldest sibling’s birthday month and year? What high school did you attend? What school did you attend for sixth grade? What was the last name of your third grade teacher? What was your childhood phone number? What hospital were you born in? And, of course…
- 10. But if youneed to guess… First name Favorite team Family name First/favorite petColor of first car Street names (by state)
- 11. Some questions arejust bad! • “What is your favorite season?” (eDisclosure/SouthTech Systems) Only 4 choices, unless you include “football”, “strawberry”, etc. • “Who is the first president you voted for?” (California DMV) Very limited choices, especially if approximate age of user known • “What is the year in which you were married? (YYYY)” (Fidelity Investments) Easy to guess, especially if user is young
- 12. False negatives, too •Many questions have more than one “right” answer: • “What is the last name of your childhood best friend?” • “What is your favorite color?” • “What is the name of a college you applied to but didn’t attend?” • Many questions have ambiguous formatting, difficult to canonicalize: • (213) 555-2368 vs. 213/5552368 and +44 7786 230167 vs (07786) 230167 • West Maple Street vs. W. Maple St. • Throttling strategies need to accommodate guessing by the intended user as well as by attackers
- 13. What to do? •Challenge questions might have some role in nuisance limitation • Example: Challenging user prior to sending password reset email • Choose questions that have deterministic, hashable answers • Don’t expect any real security, even when multiple questions are asked • Consider insider threats, e.g., disgruntled ex-spouses
- 14. References • M. Justand D. Aspinall. Personal choice and challenge questions: a security and usability assessment. In Proceedings of the 5th Symposium on Usable Privacy and Security, pages 1–11. ACM, 2009. • Joseph Bonneau, Mike Just and Greg Matthews. What's in a Name? Evaluating Statistical Attacks on Personal Knowledge Questions. FC '10: The 14th International Conference on Financial Cryptography. Tenerife, Spain. • Joseph Bonneau, Elie Bursztein, Ilan Caron, Rob Jackson, and Mike Williamson. 2015. Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google. In Proceedings of the 24th International Conference on World Wide Web (WWW '15). International World Wide Web Conferences Steering Committee, Republic and Canton of Geneva, Switzerland, 141-150. • OWASP, Choosing and Using Security Questions Cheat Sheet https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet • Insecurity Questions blog, https://insecurityq.wordpress.com
- 15.