Collaborate Disseminate
When you sign into Bank of America on a computer you haven’t used with them before, the site prompts you to answer one of your security questions.
How exactly does this make the site more secure?
Is the assumption that if … Continue reading Does prompting for security questions on new computers add any security on banking websites?
If the input for the security question is completely digital, should the answer to a security question be hashed (or at least encrypted) on the authentication server?
Continue reading Is storing answers to security questions in plain text bad form?
Possible Duplicate:
Do security questions subvert passwords?
Is it true that on some websites (e.g.: free webmail) there are “security questions” – if the user forgets about his password he could answer the securit… Continue reading How do security questions work? [duplicate]
Question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An account password reset process … Continue reading Should security question answers be case-sensitive?
If a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone try cracking the password instead of the security question? I assume most answers to these are shorter and… Continue reading Do security questions subvert passwords?