Collaborate Disseminate
Signing up for a medical records service today, in addition to security questions (sigh) I was prompted with a field that read:
Security Phrase for Email Messages:
Your security phrase will be included with all email communications to ver… Continue reading User-provided phrase to verify email sender- Is this a good idea?
Signing up for a medical records service today, in addition to security questions (sigh) I was prompted with a field that read:
Security Phrase for Email Messages:
Your security phrase will be included with all email communications to ver… Continue reading User-provided phrase to verify email sender- Is this a good idea?
Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the purpose of typing in data which is not perm… Continue reading Are security questions considered as 2FA?
I recently found several secret conversations with device added and removed notations on my spouse’s account and I’m wondering if this proves that she is engaged in secret conversations
When we set up security questions, assuming we answer fairly, we give out to the site our secrets, facts from our past. I wonder if the following is considered:
we are encouraged to use a different password for every account, but our moth… Continue reading Do security questions pose threat to the user?
I am developing an application and users are able to add 2FA to their account. however if a user has lost backup codes of 2FA and logged out of account on all of devices, is it safe making them able to disable 2FA using pre-s… Continue reading is it secure to make user able to disable 2FA with 2 security questions if they have lost backup codes?
So the original security model was to ask the user for an email address, at time of account creation, and if they forgot their password the system would email a new password to this email address.
The idea now, however, seem… Continue reading How are "security questions" not a major security hole for any application that uses them?
Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary, but legally).
Here is … Continue reading Is this "forgotten-password" procedure safe/legal?
Is it a good practice, or is it obsolete? I’m asking because I’ve never managed to remember a single security question, thus I always write down the answers. I think they are useless, long passwords or 2FA is a much better practice.
From time to time, some web sites asks to enter a security question and an answer for it. The question list is standard and it usually includes “What is your mother’s maiden name?”.
Most persons will use their mother’s real … Continue reading Why is Mother’s Maiden Name still used as a security question?