{"id":11805,"date":"2008-01-30T10:17:00","date_gmt":"2008-01-30T17:17:00","guid":{"rendered":"http:\/\/hill-kleerup.org\/blog\/wp\/2008\/01\/30\/there-are-indeed-stupid-questions.html"},"modified":"2008-01-30T10:17:00","modified_gmt":"2008-01-30T17:17:00","slug":"there_are_indeed_stupid_q","status":"publish","type":"post","link":"https:\/\/hill-kleerup.org\/blog\/2008\/01\/30\/there_are_indeed_stupid_q.html","title":{"rendered":"There are, indeed, stupid questions"},"content":{"rendered":"

Especially when it comes to those “security verification” questions<\/a> on e-commerce and banking websites.<\/p>\n

\n

While the concept of security questions is easy to grasp, the questions themselves are deeply weird and unanswerable. According to goodsecurityquestions.com<\/a>, a how-to site operated by a Web usability expert, the best ones have four qualities<\/a>: The answers are simple, memorable, can’t be guessed easily, and don’t change over time. Many questions we’re all familiar with fail to match those specs. There are the ones that are too easy\u2014I’m guaranteed to know my pet’s name, but it’s also elementary for a hacker to score that information. On the other side are the questions you can’t answer or won’t remember how you answered\u2014your first-grade teacher’s last name, your favorite rock band.<\/p>\n

Whereas it’s easy to think of lousy questions, it’s pretty much impossible to think of even one great one. Securitywise, though, a question is strong if it’s unique: If every financial institution asked for your pet’s name, phishers could focus all of their energy on sussing out that data. Gaffan says that RSA gives banks 150 questions to choose from, with the understanding that not every question will work for everyone. The problem isn’t a failure of imagination on the part of the question-conjurers. It’s the impossibility of coming up with a question that’s easy to answer but hard to guess. After throwing in the caveat that “there is no one perfect question,” the proprietor of Good Security Questions lists 16 that he considers the best<\/a>. Almost all of them are terrible. What was your childhood nickname?<\/em> Didn’t have one, sadly. What is the name of your favorite childhood friend?<\/em> Do Legos count as a friend? What is your oldest sibling’s birthday month?<\/em> I’m guessing it would take a hacker two tries to get to February.<\/p>\n<\/blockquote>\n

Alas, it seems the whole Secret Question tool is just going to continue to be used.  It’s easy to implement and it’s a lot cheaper for sites to use than most of the alternatives.  Since it’s the sites making the decision what security to use, guess what they’re going to select.<\/p>\n","protected":false},"excerpt":{"rendered":"

Especially when it comes to those “security verification” questions on e-commerce and banking websites. While the concept of security questions is easy to grasp, the questions themselves are deeply weird…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[20],"tags":[],"class_list":["post-11805","post","type-post","status-publish","format-standard","hentry","category-hi-tech"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":128496,"url":"https:\/\/hill-kleerup.org\/blog\/2015\/11\/03\/bad-questions-to-ask-it.html","url_meta":{"origin":11805,"position":0},"title":"Bad questions to ask IT","author":"***Dave","date":"Tue 3-Nov-15 5:26pm","format":false,"excerpt":"As a guy who still gets IT questions (love you, Mom), these ring true in a personal and professional setting. Especially Number 2 (the car metaphor is an excellent one (and is probably good advice for when you go see your mechanic, too)).Nobody knows everything, and heaven knows I ask\u2026","rel":"","context":"In "~PlusPosts"","block_context":{"text":"~PlusPosts","link":"https:\/\/hill-kleerup.org\/blog\/category\/blogging\/plusposts"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4236,"url":"https:\/\/hill-kleerup.org\/blog\/2003\/10\/10\/homeland_insecu.html","url_meta":{"origin":11805,"position":1},"title":"Homeland insecurity","author":"***Dave","date":"Fri 10-Oct-03 8:53am","format":false,"excerpt":"Partisan sniping aside, 9\/11 provided ample sentiment among the populace to go along with increased security measures -- if they seem serious, and if they're well-managed. And then there's this...","rel":"","context":"In "Homeland Security"","block_context":{"text":"Homeland Security","link":"https:\/\/hill-kleerup.org\/blog\/category\/politics-law\/homeland-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":9480,"url":"https:\/\/hill-kleerup.org\/blog\/2006\/06\/28\/do_you_have_wha.html","url_meta":{"origin":11805,"position":2},"title":"Do you have what it takes to be a citizen?","author":"***Dave","date":"Wed 28-Jun-06 1:50pm","format":false,"excerpt":"MSNBC provides twenty sample questions: When immigrants want to become Americans, they must take a civics test as part of their naturalization interview before a Citizenship and Immigration Services officer....","rel":"","context":"In "Politics & Law"","block_context":{"text":"Politics & Law","link":"https:\/\/hill-kleerup.org\/blog\/category\/politics-law"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":740,"url":"https:\/\/hill-kleerup.org\/blog\/2001\/11\/17\/if_theres_a_sec.html","url_meta":{"origin":11805,"position":3},"title":"If there’s a security risk — then check it for God’s sake","author":"***Dave","date":"Sat 17-Nov-01 3:02pm","format":false,"excerpt":"First we have some brainless yahoo dodging past security guards who did nothing to stop him. Then we get a neuroscientist kicked off a plane, no questions asked, no security...","rel":"","context":"In "Homeland Security"","block_context":{"text":"Homeland Security","link":"https:\/\/hill-kleerup.org\/blog\/category\/politics-law\/homeland-security"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":9431,"url":"https:\/\/hill-kleerup.org\/blog\/2006\/07\/07\/security_measur.html","url_meta":{"origin":11805,"position":4},"title":"Security measures","author":"***Dave","date":"Fri 7-Jul-06 9:44pm","format":false,"excerpt":"Had an interesting experience today. My primary credit card has been flaky of late in being passed for purchases, and a few days ago I got a call from the...","rel":"","context":"In "Big Business"","block_context":{"text":"Big Business","link":"https:\/\/hill-kleerup.org\/blog\/category\/big-business"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2996,"url":"https:\/\/hill-kleerup.org\/blog\/2002\/08\/23\/give_it_to_pila.html","url_meta":{"origin":11805,"position":5},"title":"“Give it to Pilar — and only to Pilar”","author":"***Dave","date":"Fri 23-Aug-02 2:50pm","format":false,"excerpt":"Wonder of wonder and miracle of miracles, the TSA may actually issue a common-sense amendment to the idiocy that passes for airport security these days. To wit, those annoying questions...","rel":"","context":"In "Politics & Law"","block_context":{"text":"Politics & Law","link":"https:\/\/hill-kleerup.org\/blog\/category\/politics-law"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/posts\/11805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/comments?post=11805"}],"version-history":[{"count":0,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/posts\/11805\/revisions"}],"wp:attachment":[{"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/media?parent=11805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/categories?post=11805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hill-kleerup.org\/blog\/wp-json\/wp\/v2\/tags?post=11805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}