"What was the name of your first pet?" A question like that can undo all your good password work. This guide belongs to our guide to securing your key accounts.
Why security questions are weak
They are a second password that everyone can look up:
- Public. Your mother's maiden name, your school and your hometown are often online.
- Guessable. Favorite colors and foods have few likely answers.
- Shared. Friends and family know them.
- Harvested. Social media quizzes collect them. See social media security.
- Reused. The same answers apply on every site, and they can leak in data breaches.
- Permanent. You cannot change the street you grew up on.
Because they often let you reset a password, they can be a back door into an account that is otherwise strong.
What the experts say
NIST's digital identity guidelines tell services not to use "knowledge-based" prompts, such as asking for the type of secret answer that you set up. Many large services have dropped them in favor of app-based recovery. Plenty of others have not.
The fix: random answers
Treat each answer as a password:
- Open your password manager.
- Generate a random answer, such as a few unrelated words.
- Enter it as your answer.
- Save the question and answer in the login's notes.
Your "first pet" is now velvet tugboat ninety. This is only an example, so make up your own.
| Question | Honest answer | Better answer |
|---|---|---|
| First pet | Easy to find out | Random words |
| Mother's maiden name | Public record | Random words |
| Favorite teacher | Known to classmates | Random words |
Phone support
If a call center asks for the answer, you will need to read it out, so random words work better than symbols. If a service lets you, use a voice PIN or an app check instead.
Clean up what you have
Next time you log in to your bank, email or old accounts, look for security questions in the settings. Replace them, or remove them if that is an option. Add this to your yearly password check-up.