Is storing the answer to a secret question any more secure than storing a password?

Question

Reading what is currently the top answer to a recent question on how/whether to send users their passwords, I was intrigued that the most popular answer said the following...

1. storing passwords in such a way that they are retrievable is insecure
2. using a reset feature with the help of a secret question is a valid alternative

(These two points seem contradictory.)

I use hashed passwords for security, but I've always assumed that the password question and answer scheme are even less secure because they actually give a hint as to what the answer may be. (I often use .NET's default membership provider.)

Is there something I'm missing because I've not bothered to use the question & answer? Are secret question and answers, without incorporating any sort of timed email reset function, any more secure than storing a password in the db?

---

Follow Up: Microsoft's membership provider uses the same format for storing answers to secret questions as they do for the password. If you specify hashed for the password, then it will store the secret answer the same way.

From the posts below, it appears that, if used, a secret question/answer mechanism should only be used in addition to an email reset scheme, rather than instead of, and should be hashed as well. This, of course, may present problems for people like me who put long random strings in the secret answer section.

Answer 1

Secret questions and answers are only as secure as the user makes them to be. If someone knows anything about you, they can answer an easy question and reset your password. I'm guessing answers are also hashed, so that the answer is not directly stored. But again, knowing the answer to the question is all it takes.

A hashed password stored is about as secure as most applications get, and that's fine because it's one way, and thus the plain text is never stored nor can it be retrieved.

Answer 2

The question and answer idiom has been exploited in many published "email hacks" (example)- I'd certainly avoid using it.

Answer 3

It depends also how related the secret question / answer are.

Case in point, when I'm presented with the option to put in a question I put in something like:

Question: Groovy Broccoli?

Answer: International Space Station 431

These are not actual question/answers I use, but I can assure you that the questions I use provide no clue whatsoever as to the answer.

Answer 4

Passwords are answers to a 'secret' question. That question is, "what is your password?".

As Scunliffe points out, adding an additional field of user input may or may not increase the security of the password - that depends on the user's practices.

Answer 5

I would argue that a secret question/ answer combination is just another form of "password". I would then go on to suggest that a secret answer is probably weaker than a regular password, as there is rarely any suggestion that it should be anything other than regular words that are susceptible to dictionary attacks. In most cases, the dictionary space of the answer is significantly shortened by the context of the question (scunliffe's exception noted, however).

Answer 6

If you can get into the system by using the secret question, then that system is just as secure as the method with which the secret question is stored.

However, if a user uses their same password on other systems, then at least making sure the password is hashed keeps that user's password from being outted on other systems, like their online bank.

Answer 7

One site I've been on (bank or health insurance) required me to answer six secret questions. For a password reset, they'd choose three of those at random and require me to answer them.

In addition, I presume they'd only store the hashed answers, not the plain text version. As DDaviesBrackett has said, the password is a secret question.

Answer 8

The crux of the security of the secret question usually lies in an alternate trusted communication medium. If the user answers the 'secret question' correctly, the server should provide a random password via the trusted channel (e.g. email address).

Then, using that random password (which is as safe as the user's email), he can use it to log in and change the password to something else.

Answer 9

That depends on the security needs you require... And once they have already answer that part.

The only thing i have to add, its that you use MD5 encryption for storing passwords, and other sensitive data. Be aware that on the present time its next to impossible to discover the "phrase" encrypted by MD5. You can find loads of articles talking about it. And isn't difficult to implement in your projects.

Regards. Fábio Antunes

Answer 10

I feel like part of your question is being overlooked. Cause like you I see how we are somehow overlooking the common sense that if you should not store their password in plain text yet you are willing to store their answer to their 'secret question' in plain text and then allow them reset their password via a link sent through email, than why even have a secret question and just email them their the reset link. Of course you could just as easily encrypt the answer to the question.

It seems that many people, myself included, write their question/answer in some encrypted where the question does not provide a hint, but I'm always asking myself when I create these - "if I don't remember the password that I am going to be using every time I come to this site, how will I ever remember my answer that I made up 2 years ago and have never used."

My Opinion: The whole idea of the 'secret question' is just a sense of false security, as if adding the addition of the secret question is going to make the process of hacking into my account so much harder that the one extra step will frustrate the hacker and cause him to give up.

It seems more likely that it will just provide a clue to a friend or family member you wants to screw with me.

Answer 11

i would use a secret question to determine if I should or shouldn't send them a newly generated password via an email. Never to let them set a new one. At the end of the day though, it all comes down to make it as secure as it needs to be. If you're an online bank or a networking site makes a huge difference.

Answer 12

I allow myself to be guided by OWASP here:

They are unacceptable for the following reasons:

• Collection of information about people without their explicit consent (such as "Mother's maiden name") is illegal in most privacy regimes. Such collection is subject to privacy laws, review and correction by the subject, and so on.

• IT Security Policies and standards such as ISO 27000 prohibit the clear text storage of passwords, but almost all Q&A schemes store both the question and answer in the clear

• The information in the answers is public for a goodly portion of the users of the Internet, and thus is found using public sources

Answer 13

"Greetings, Professor Falken." or why it is not a good idea to base any authentication scheme on non-secret, non-random-"ish" responses.

And, if you try to be a little tricky and choose random-"ish" responses to the notorious maiden-name-questions and are able to remember them AFTER you have forgotten your password (and probably have changed it a few times since setting the "secret question".

Nay, the whole secret-questions scheme is botched from the start. For a start, the question is not secret but revealed to anybody claiming to have mislaid your password.