Security Questions
A knowledge-based identity verification method in which users answer preset questions, such as a mother's maiden name, to verify identity. Because answers can be guessed, derived from public information, or obtained through social engineering, and may change over time, standards bodies such as NIST regard it as an insecure account recovery method.
Timeline (last 90 days)
The reasons security questions were phased out include that answers can be guessed (derived from public information, social media or data breaches) and that answers have poor stability (such as addresses, phone numbers and marital status changing).
The suggested migration roadmap: inventory processes that depend on security questions, remove security questions from new user registration and guide users to set up recovery codes or bind authenticators, and prompt existing users to add recovery methods and set a transition period.
Removing security questions is not simply deleting a form field; it involves restructuring the recovery flow, user education and adjustments to customer service processes.
All Facts (3)
The reasons security questions were phased out include that answers can be guessed (derived from public information, social media or data breaches) and that answers have poor stability (such as addresses, phone numbers and marital status changing).
50%UnverifiedThe suggested migration roadmap: inventory processes that depend on security questions, remove security questions from new user registration and guide users to set up recovery codes or bind authenticators, and prompt existing users to add recovery methods and set a transition period.
50%UnverifiedRemoving security questions is not simply deleting a form field; it involves restructuring the recovery flow, user education and adjustments to customer service processes.
50%