Choosing and Using Security Questions Cheat Sheat

= Introduction =

This cheat sheet provides some best practice to follow when choosing and using security questions to implement a &quot;forgot password&quot; web application feature.

= The Problem =

There is no industry standard either for providing guidance to users or developers when using or implementing a Forgot Password feature. The result is that developers generally pick a set of dubious questions and implement them insecurely. They do so, not only at the to their users, but also--because of potential liability issues--at the risk to their organization. Ideally, passwords would be dead, or at least less important in the sense that they make up only one of several multi-factor authentication mechanisms, but the truth is that we probably are stuck with passwords just like we are stuck with Cobol. So with that in mind, what can we do to make the Forgot Password solution as palatable as possible?

= Choosing Security Questions =

Most of us can instantly spot a bad &quot;security question&quot; when we see one. You know the ones we mean. Ones like "What is your favorite color?" are obviously bad. But as the [Good Security Questions] web site rightly points out, there really are NO GOOD security questions; only fair or bad questions.

The reason that most organizations allow users to reset their own forgotten passwords is not because of security, but rather to reduce their own costs by reducing their volume of calls to their help desks. It's the classic convenience vs. security trade-off, and in this case, convenience (both to the organization in terms of reduced costs and to the user in terms of simpler, self-service) almost always wins out.

So given that the business aspect of lower cost generally wins out, what can we do to at least raise the bar a bit.

Here are some suggestions. Note that we intentionally avoid recommending specific questions. To do so likely would be counterproductive because many developers would simply use those questions without much thinking and adversaries would immediately start harvesting that data from various social networks.

Step 1) Decide on Canned Questions vs. Create Your Own Questions
Believe it or not, there is a certain merit to allow your users to select from a set of several "canned" questions. We generally ask users to fill out the security questions as part of their initial user profile and often that is the very time that the user is in a hurry; they just wish to register and get about using your site. If we ask users to create their own question(s) instead, they then generally do so under some amount of duress.

However, there is also some strong rationale to requiring users to create their own question(s), or at least one such question. The prevailing legal opinion seems to be if we provide some sort of reasonable guidance to users in creating their own questions and then insist on them doing so, at least some of the potential liabilities are transferred from our organization to the users. In such cases, if a user account gets hacked because of weak security questions (e.g., "What is your favorite sports team?", etc.) then the thought is that they only have themselves to blame and thus our organization is less likely to get sued.

Since OWASP recommends in the Forgot Password Cheat Sheet that multiple security questions should be posed to the user and successfully answered before allowing a password reset, a good practice might be to require the user to select 1 or 2 questions from a set of canned questions as well as to create (a different) one of their own and then require they answer one of their selected canned questions as well as their own question.

Step 2) Review Any Canned Questions with Your Legal Department or Privacy Officer
While most developers would generally first review any potential questions with whatever relevant business unit, it may not occur to them to review the questions with their legal department or chief privacy officer. However, this is advisable because their may be applicable laws or regulatory / compliance issues to which the questions must adhere. For example, in the telecommunications industry, the FCC's Customer Proprietary Network Information (CPNI) regulations prohibit asking customers security questions that involve "personal information", so questions such as "In what city were you born?" would likely not be allowed.

Step 3) Insist on a Minimal Length for the Answers
Even if you pose decent security questions, because users generally not putting a whole lot of forethought into answering the questions, they often will just answer with something short. Answering with a short expletive is not uncomment, nor is answering with something like "xxx" or "1234". If you tell the user that they *should* answer with a phrase or sentence and tell them that there is some minimal length to an acceptable answer (say 10 or 12 characters), you generally will get answers that are someone more resistant to guessing.

Step 4) Consider How To Securely Store the Questions and Answers
There are two aspects to this...storing the questions and storing the answers. Obviously, the questions must be presented to the user, so the options there are store them as plaintext or as reversible ciphertext. The answers technically do not need to be ever viewed by any human so they could to stored using a secure cryptographic hash (although in principle, I am aware of some help desks that utilize the both the questions and answers for password reset and they insist on being able to _read_ the answers rather than having to type them in; YMMV). Either way, we would always recommend at least encrypting the answers rather than storing them as plain text. This is especially true for answers to the "create your own question" type as users will sometimes pose a question that potentially has a sensitive answer. (E.g., "What is my bank account # that I share with my wife?")

So the main question is whether or not you should store the questions as plaint text or encrypted. Admittedly, we are a bit biased, but for the "create your own question" types at least, we recommend that such questions be encrypted. This is because if they are encrypted, it makes it much less likely that your company will be sued because you have some bored, rogue DBAs pursuing the DB where the security questions and answers are stored in an attempt to amuse themselves and stumble upon something sensitive or perhaps embarrassing.

In addition, if you explain to your customers that you are encrypting their questions and hashing their answers, they might feel safer about asking some questions that while potentially embarrassing, might be a bit more secure. (Use your imagination. Do we need to spell it out for you? Really???)

Step 5) Periodically Have Your Users Review their Questions
Many companies often ask their users to update their user profiles to make sure contact information such as email addresses, street address, etc. is still up-to-date. Use that opportunity to have your users review their security questions. (Hopefully, at that time, they will be in a bit less of a rush, and may use the opportunity to select better questions.) If you had chosen to encrypt rather than hash their answers, you can also display their corresponding security answers at that time.

If you keep statistics on how many times the respective questions has been posed to someone as part of a Forgot Password flow, it would be advisable to also display that information. (For instance, if against your advice, they chose a question such as "What is my favorite hobby?" and see that it had been presented 113 times and they think they might have only reset their password 5 times, it would probably be advisable to change that security question.)

= Using Security Questions =

= Related Articles = Forgot Password Cheat Sheet

= Authors and Primary Editors =

Kevin Wall - kevin.w.wall[at]gmail com

= Other Cheatsheets =