We all know that security questions suck, but still they're often used as the authentication of last resort to reset forgotten passwords. What are some secure and unsecure ones you've used or seen?
Use community owned answers for voting. Up-vote secure questions. Down-vote unsecure questions. Explain in comments.
What is your favorite sexual position? =P
...lets see an ID thief steal that tidbit from the public records.
No such thing as a good pre-chosen question. The user should be allowed to chose their own security question, so they can pick one that is difficult to guess. At the very least, if you must offer a dropdown, put in "Enter my own..." as an option.
Unless its something, that you truly have a hard time answering, its probably not good enough if its prechosen.
Security questions are outdated, use email. If its an email system, use really really obscure information that almost no-one would know. If its not an email system, there is no excuse for you to rely on such outdated technology.
"What is a good security question?"
That seems like it would be very difficult to predict.
For the sake of rediculousness in these questions, my favorite would be.
How about number of Bands in your finger print?
Waste size in milimeters?
Percapita number of freckles on your arm?
Agreeing with John here. Just about any such question either will be easily found out (What is the name of your dog was the sequrity question for one of Paris Hiltons accounts if the rumours are true), easily socially engineered ("Hi, you have won a free milkshake in our random sweepstakes, what flavour would you like?") or the number of answers is too small for it to give any type of security (How many sexual positions do you know the name to? No, don't really answer this...)
My bank uses a series of questions regarding my account to add security, like "Do you have an extra card connected to the account?" "Do you have a fund-account as well?"... Using 3 or 4 such questions. That solution is slightly more secure, but still could be guessed so that 10 calls or so would give a random, answer that cracked it (Most people do not have extra cards, probably most don't have stock...)
I would evaluate questions asking myself:
Using those criteria on common "security" questions, I come to the conclusion that they suck.
The trend is usually to ask questions that bring up semi-pleasant childhood memories or neutral factual questions.
But what gets burned on people's brains are negative memories, so I think questions like these would be effective:
Of course, the side effect is your users will hate you for bringing these unpleasant memories to mind, but I'm pretty sure they'll remember them.
I guess if you're going to ask a specific question, it's better to have it rely on something in the user's office/home/whatever. For example, you could say
"Enter a line of text from a piece of paper on your desk."
It's much less likely that someone is going to guess that passphrase. Of course, if they do break into your office and see a memo on the wall with a star next to a particular line, they might make that connection ... and if you're not in your office, you're not likely to remember it yourself.
Usually I select any question and answer with a keyword (like a second password...)
I'd suggest anything that is not publicly available information -- just ask Sarah Palin.
What is the ratio of the weight of your left leg to the length of your middle finger.
This question is easily answered by the leg and finger owner, but would prove difficult for others to determine.
Good presentation about MMN questions..
Good security questions are a misnomer. They actually create a vulnerability into a system. We should call them in-secure questions. However, recognizing the risk and value they provide, "good" security questions should have 4 characteristics: 1. cannot be easily guessed or researched (safe), 2. doesn't change over time (stable), 3. is memorable, 4. is definitive or simple. You can read more about this at http://www.goodsecurityquestions.com.
Here's a list of good, fair, and poor security questions.