Password Recovery Questions are a Terrible Way to Protect Online Accounts

Password Recovery Questions are a Terrible Way to Protect Online Accounts

A new research paper found that people often choose obvious answers that are easy for hackers to guess

According to a new research paper, Google staffers found that security questions which are often used to help users recover passwords are one of the worst ways to protect online accounts. The company studied hundreds of millions of actual question-and-answer combos used by real Google users, and discovered people often choose obvious answers that are easy to remember, but also easier for hackers to guess.

The study estimates that an attacker would have a 20 percent chance of guessing an English speaker’s answer to the question, “What is your favorite food?” by guessing “pizza” on the first try.

According to Google, 40 percent of English-speaking U.S. users have failed to recall their answers to security questions.

Instead of using these questions, Google recommends using authentication through text messages or alternate email addresses in order to boost security and help users recover lost passwords. When SMS messages are used as a recovery method, people are able to get back into their accounts more than 80 percent of the time.

About the Author

Matt Holden is an Associate Content Editor for 1105 Media, Inc. He received his MFA and BA in journalism from Ball State University in Muncie, Indiana. He currently writes and edits for Occupational Health & Safety magazine, and Security Today.

Featured

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.