Personal knowledge questions for fallback authentication: security questions in the era of Facebook

ABSTRACT

Security questions (or challenge questions) are commonly used to authenticate users who have lost their passwords. We examined the password retrieval mechanisms for a number of personal banking websites, and found that many of them rely in part on security questions with serious usability and security weaknesses. We discuss patterns in the security questions we observed. We argue that today's personal security questions owe their strength to the hardness of an information-retrieval problem. However, as personal information becomes ubiquitously available online, the hardness of this problem, and security provided by such questions, will likely diminish over time. We supplement our survey of bank security questions with a small user study that supplies some context for how such questions are used in practice.

REFERENCES

• 1: Maltego. Available online: http://www.paterva.com/maltego/.
• 2: F. Asgharpour and M. Jakobsson. Adaptive Challenge Questions Algorithm in Password Reset/Recovery. In First International Workshop on Security for Spontaneous Interaction: IWISSI '07, September 2007.
• 3: J. Chao. Trend in canine names reflects the times. San Francisco Examiner, page B1, Oct 12 1997.
• 4: Facebook. Statistics. http://www.facebook.com/press/info.php?statistics.
• 5: A. Felt and D. Evans. Privacy Protection for Social Networking Platforms. In Web 2.0 Security and Privacy 2008, May 2008.
• 6: An inquiry into the nature and causes of the wealth of internet miscreants, Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315292]
• 7: L. Frieder and J. Zittrain. Spam Works: Evidence from Stock Touts and Corresponding Market Activity. Berkman Center Research Publication, 2006.
• 8: Simson L. Garfinkel, Email-Based Identification and Authentication: An Alternative to PKI?, IEEE Security and Privacy, v.1 n.6, p.20-26, November 2003 [doi>10.1109/MSECP.2003.1253564]
• 9: V. Griffith and M. Jakobsson. Messin' with Texas: Deriving mothers maiden names using public records. In Applied Cryptography and Network Security (ACNS). Springer, 2005.
• 10: William J. Haga , Moshe Zviran, Question-and-answer passwords: an empirical evaluation, Information Systems, v.16 n.3, p.335-343, 1991 [doi>10.1016/0306-4379(91)90005-T]
• 11: Markus Jakobsson , Erik Stolterman , Susanne Wetzel , Liu Yang, Love and authentication, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357087]
• 12: Mike Just, On the Design of Challenge Question Systems, IEEE Security and Privacy, v.2 n.5, p.32-39, September 2004 [doi>10.1109/MSP.2004.80]
• 13: M. Mannan and P. van Oorschot. Security and usability: The gap in real-world online banking. In New Security Paradigms Workshop (NSPW'07), September 2007.
• 14: NYC Department of Health. "Health Department Announces Most Popular Dog Names and Breeds of 2005". Available online: http://www.nyc.gov/html/doh/html/pr2006/pr122-06.shtml, December 27 2006.
• 15: Office of the Privacy Commissioner of Canada. "Guidelines for Identification and Authentication". Available Online. http://www.privcom.gc.ca/information/guide/auth_061013_e.asp, October 2006.
• 16: L. O'Gorman, A. Bagga, and J. Bentley. Call Center Customer Verification by Query-Directed Passwords. In Financial Cryptography: 8th International Conference, FC 2004, Key West, FL, USA, February 9--12, 2004: Revised Papers. Springer, 2004.
• 17: L. Saad. Lincoln Resumes Position as Americans' Top-Rated President. Available online: http://www.gallup.com/poll/26608/Lincoln-Resumes-Position-Americans-TopRated-President.aspx, February 19 2007.
• 18: Social Security Administration. "Identity Theft and Your Social Security Number". SSA Publication No. 05-10064. Available online: http://www.socialsecurity.gov/pubs/10064.html, October 2007.
• 19: Social Security Administration. RSA Identity Verification. Available online. http://www.rsa.com/node.aspx?id=3347, 2008.
• 20: Social Security Administration. The SSN Numbering Scheme. Available online. http://www.socialsecurity.gov/history/ssn/geocard.html, Not Dated.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Security

General Terms:
Human Factors, Security

Keywords:
authentication, questions, security