It's No Secret. Measuring the Security and Reliability of Authentication via “Secret” Questions

Abstract

All four of the most popular webmail providers -AOL, Google, Microsoft, and Yahoo! -rely on personal questions as the secondary authentication secrets used to reset account passwords. The security of these questions has received limited formal scrutiny, almost all of which predates webmail. We ran a user study to measure the reliability and security of the questions used by all four webmail providers. We asked participants to answer these questions and then asked their acquaintances to guess their answers. Acquaintances with whom participants reported being unwilling to share their webmail passwords were able to guess 17% of their answers. Participants forgot 20% of their own answers within six months. What's more, 13% of answers could be guessed within five attempts by guessing the most popular answers of other participants, though this weakness is partially attributable to the geographic homogeneity of our participant pool.

A study into the usability and security implications of text and image based challenge questions in the context of online examination

“…Challenge question authentication is a knowledge-based feature, which is widely seen as a credential recovery technique (Just and Aspinall 2009a;Schechter et al 2009). This method has been used as a second factor feature and employed for customer verification in online and telephone banking (Rabkin 2008;Just and Aspinall 2012).…”

“…Security findings of their study indicate low security level for 5 of their 60 questions. Schechter et al (2009) Renaud and Just (2010) proposed associative picture based cues with multiple choice answers, which achieved a 13% increase in the memorability with 77% correct answers. However, the security analysis revealed that 38% of the times, answers were guessed by close friends.…”

“…However, the following usability and security issues were identified. These issues were identified in the text-based questions as discussed in the literature review above (Just and Aspinall 2009a, c;Schechter et al 2009). …”

“…Text-based questions were based on the most common types implemented by leading email providers for credential recovery. For example AOL utilizes favourite and personal questions, Google uses a small set of personal questions and Microsoft and Yahoo implement a combination of personal and favourite questions (Schechter et al 2009). …”

“…We implemented an string-tostring comparison algorithm for authentication purposes (Schechter et al 2009;Ullah et al 2014a). Results in Table 4 show that, of the 890 text-based challenge questions randomly presented to students, 583 (66%) were answered correctly during the authentication process using an equality algorithm, which would increase to 74% if a more relaxed algorithm was implemented.…”