{"id":480,"date":"2008-09-25T02:56:48","date_gmt":"2008-09-25T07:56:48","guid":{"rendered":"http:\/\/www.mccambridge.org\/blog\/?p=480"},"modified":"2022-09-11T00:40:37","modified_gmt":"2022-09-11T00:40:37","slug":"a-note-about-security-questions","status":"publish","type":"post","link":"http:\/\/www.mccambridge.org\/blog\/2008\/09\/a-note-about-security-questions\/","title":{"rendered":"A Note About Security Questions"},"content":{"rendered":"

I saw a post at Schneier on Security<\/a> this evening that I wanted to highlight.\u00a0 In light of the Palin email hack incident, Bruce Schneier discusses the “extra security questions”<\/a> that various websites will ask you to verify your identity in case you’ve lost your password.\u00a0 You’ve seen these: the things like, “What was your first high school mascot?”\u00a0 As Schneier points out, these are the opposite of increased security.\u00a0 In fact, they can make you more<\/em> vulnerable, because they are usually quite easy to figure out.<\/p>\n

Let’s see… Colin grew up in Green Bay, WI.\u00a0 Even counting the parochial schools and allowing that he might live as far away from Green Bay as, say, a radius of one county in any direction, that will leave us what, maybe a dozen school districts and perhaps two dozen high school mascots to try?\u00a0 Hmm… what is harder to guess: a 8-12 character password of letters and numbers (368<\/sup>+…+3612<\/sup> = 4,784 million billion possibilities) to log in to my account, or a high school mascot (24 possibilities) to get the opportunity to pick<\/em> the password to my account?\u00a0 Even if I were from somewhere with a few more schools to pick from, say New York, the list is still, shall we say, “short” compared to the number of passwords an attacker does not<\/em> have to guess.<\/p>\n

Oh, and shucks… Looks like I just gave away the answer to “City you grew up in?”<\/p>\n

Thinking about this reminded me of a related experience from a recent ordeal in opening a bank account.\u00a0 Near the very end of the application, the bank pulled data from my credit report to “verify my online identity.”\u00a0 Presumably, they were going to ask me questions that only I or someone with very intimate knowledge of my financial situation and history could know the answers to.\u00a0 Well, two slight problems with that idea.<\/p>\n