More and more I find myself needing to add security questions to my accounts. The concept makes sense... what if you forget your password? As with most things I complain about, the problem is in the implementation.

A slight dramatization:

Before we can create an account, you need to add two security questions. Choose a question from the drop-down box and then type your answer (case sensitive).


#1:
What was the day of the week when you lost your first tooth?
How many times have you swallowed a spider while asleep?
In what city was Ralph Nader born?
What is your favorite Diablo 2 build?

#2:
왜 하필 일곱 여섯 두려워 했지?
¿Has oído el de la insomne agnóstico disléxico?
Care este răspunsul la întrebarea de viață, univers, și totul?
あなたは女の子はワイルドゴーンは好きですか？

What bothers me is that a lot of the questions are dumb or don't apply to me. Other times I'm worried the answer is complicated and I won't remember next time exactly how I typed it with capitals, punctuation, etc. I like when the same question is used on multiple websites because it's easier to keep track of your answers. For example, "In what city/town were you born?" is a good one because I put an answer for that one that isn't true but is easy for me to remember (Mar Sara).

More and more I'm finding new questions in these lists that I haven't used before. It's hard enough keeping track of passwords for dozens of servers (more and more are making you change it every so often now, to boot). To have to keep track of essentially 3 passwords is just that much worse.

You could say "just make sure you never forget your password/username" but that is difficult with how many services we utilize nowadays (unless you use the same username/pw combo for almost everything). The alternative is to write your login info down... and that honestly sounds like a terrible idea to me.

Have you been noticing this trend towards lots of varied security questions on online accounts now?

Note - I do not actually use Mar Sara for my secret answer lol (I use Braxis)

Megaliskuu

United States5123 Posts

September 13 2012 05:21 GMT

I use the same dummy answer for every website regardless of the question.

I'm so internet smart!

+ Show Spoiler +

Because this is TL and people don't understand jokes here, please realize this was a joke, Its not internet smart to do what I do.

Coramoor

Canada455 Posts

September 13 2012 05:22 GMT

That's the reality of secret questions in general, on top of which most experts in the field recommend that you answer with random code words that have no relation whatsoever to the question.

For example, when was the day of the week when you lost your first tooth? Protoss

something like that, just tie it to personal likes that make no general sense, it's a tough thing to remember but if you develop some kind of personal pattern, or a list of like 10 items that it will be from that tends to keep your other accounts secure in situations where *i'm looking at you blizzard* security questions get hacked.

EtherealDeath

United States8366 Posts

September 13 2012 05:29 GMT

I have an easy solution to this, and it works as long as I'm using a qwerty keyboards. My passwords/secret question answers are geometric patterns on the keyboard with a defined ordering, which is varied between passwords but is very easy to remember. So I end up with length, immunity to tables, and complexity in the sense that numbers, special characters, and capital and lowercase letters are involved.

Great way to do things. An example might be something like !1Qazxcdews@#

StorrZerg

United States13921 Posts

September 13 2012 05:29 GMT

Personally I'm having a lot of trouble with blizzard lately, locking my acct 4-5 times within the past week, sending me as many as 15 emails in 15 mins regarding my acct being locked. Every time I have to reset my password. I login on my acct from different locations which is probably the reason or i miss type my password, cause i use an old one. I've tried talking to support, and i just get a bunch of bs in return, i just wish a person would actually talk back instead of pasting the "usual crap".

Personally, I agree with the answering of questions with something random, unrelated.

Aerisky

United States12129 Posts

September 13 2012 05:45 GMT

Yes, this is so true. Letting us just write our own question would help out so very, very much -_-

I was actually just thinking about this a few days ago

starfries

Canada3508 Posts

September 13 2012 05:57 GMT

type the last word of the question, backwards!
+ Show Spoiler +

note I don't recommend this approach either unless you scramble it with a master password or something

Jikan No Muda

39 Posts

September 13 2012 06:57 GMT

"No, I ask the questions."

Usually gets me through, funny how it works.

stenole

Norway869 Posts

September 13 2012 09:40 GMT

If you have too many accounts to manage, maybe a good idea would be to pick a fixed word and blend it with something from the web site or security question. Like:

Word: Cat = CAT
Website: www.teamliquid.net -> 2 first letters + 2 last letters = TEID
Security question: Who is your father? -> last letter of each word = OSRR

Take one letter from each in order going backwards: RDTRIASECOT

Not perfect, but some of those security questions are so easy to look up for other people that I wonder how much security is there at all.

I'm more worried about managing all my passwords. For things I don't really care if get hacked or stolen I will use the same password, but then you have other things which would be more harmful if someone managed to break into them. It is not uncommon that I will not be sure which password corresponds to which thing. So I may try some passwords which are for other services and get denied. My worry is if these failed logins get logged somewhere. And then if someone breaks into that website they can find failed logins and use that to hack into the other service.

hypercube

Hungary2735 Posts

September 13 2012 14:41 GMT

#10

Security questions are a huge risk. Especially if the answer is truthful. "Where was Ralph Nader born?" Seriously? You're basing the security of your account on the assumption that the hacker doesn't know that AND can't use google?

I just use the same password for everything unimportant and a couple of secure ones for the important stuff (banking/personal email/personal computer).

Ideally I'd like to have an RSA key for at least banking and email and some kind of biometric identification for my PC.

Doomblaze

United States1292 Posts

September 13 2012 16:09 GMT

#11

I laughed so hard at あなたは女の子はワイルドゴーンは好きですか？

For stuff thats sensitive you need good passwords that don't make sense to anyone. For everything else, use password!