Re: best practices for user friendly and secure forgotten password resolution

On 8/22/09 2:15 PM, "Greg Austin" <[email protected]> wrote:

[snip]

> However, if security of a game site is in question, who cares?

The security of a game site by itself might not matter, but when you realise
that most people use the same username and password for everything from that
game site all the way up through their investment accounts, it suddenly
becomes much more important.

> In such a case, I would establish other means to ID end-users. Names
> are a start. Names of favorite pets, etc.

Bruce Schreiner, one of the best-known security experts, points out that
secret questions such as "name of favourite pet" are inherently insecure.
http://www.schneier.com/blog/archives/2005/02/the_curse_of_th.html

As was discovered when Sarah Palin's Yahoo! account was hacked, secret
questions are easy to figure out via brute force (after all, "blue" is going
to be a common answer to "what's your favourite colour") or simple web
searches (anyone who wants to answer "what's your favourite pet's name" will
find a couple of good guesses to that in just a few minutes of searching on
my name).

Aside from the insecurity of secret questions, there are significant
usability issues with them.
* Secret questions often have length requirements.  What do you do if your
mother's maiden name is Li?
* Secret questions tend to be US-centric.  "What was your high school's
mascot" has no answer if you didn't go to school in the States.
* Many questions have multiple potential answers.  My credit union's
questions include "what is your grandfather's middle name?", but I've got
two grandfathers, and "what street did you grow up on", but my family moved
a few times so I'm never sure which one I might have chosen.
* "What city was your father born in?" is something that I don't know off
the top of my head, so I either have to guess, or write it down somewhere,
or be able to call and ask.  There are plenty of questions like this which
have

> Regardless, security should not get in the way of user-centered
> design, or in any way building the app, as a car is not built around
> the ignition key.

I'm not sure that I can consider it to be good user-centred design if my
application's poor security means that their identity gets stolen.

Regards,
Nadyne.
_______________________________________________
This is the BayCHI Discussions mailing list, [email protected]
To change your subscription options, or to unsubscribe, visit http://baychi.org/mailman/listinfo/discussions