Today I was trying to cancel my RIFT account and you need to give them your secret question to cancel. Of course I have no idea what it was, so I ended up calling them and they just asked for my address, account name, and date of birth and then canceled the account. I don't know about you, but I'd think it's easier to find out this stuff compared to my password. I think although security people are always talking about passwords are obselete, it's still surprisingly good as a mechanism. Unless your password is something like 'password' it is fairly difficult to defeat it by brute force, and even if it was possible there really isn't any reason why a potential hacker will devote time to crack your password when he can just go for guys with far more insecure passwords. The major hacking stuff we heard about generally consist of the server storing the password getting hacked, and in this case it wouldn't really matter how secure your password is, especially since some of the companies actually store passwords in plain text. A keylogger would obviously defeat any amount of password, so security there probably isn't going to help.
Now of course there are better ways to do security (two-factor authentication being the most common ones), but I think secret questions are the least secure way to do it. I know my friends all know each other's secret questions if they actually picked an answer that's true as opposed to just using the secret question as another password field. After all if your secret question is 'where were you born' there really is only one correct answer to that assuming you're not lying, and this information isn't too hard to find or even guess. Another thing I noticed is that answer to these secret question are case sensitive, even though some of them can be answered as a phrase. So if the answer to your secret question is 'a and b', you could come back a few year later and not sure if you typed 'b and a' or 'A and b' or 'B and a' or 'B and A' or 'A and B', or even 'a/b'. I find that to produce answers that are even halfway reliable I'd have to write them down, and if I have to write stuff down I can also produce perfectly secure passwords too, and of course writing anything down kind of defeats the purpose of being secure in the first place.
Although security isn't easy, if you just say ignore problems where any strength password would be irrelevent (phishing, keylogger, etc), then I think this is a solved problem with well-known ways to make it practically impossible to beat by brute force. I understand security guys want to make stuff foolproof, but as someone said before, fools can be very resourceful. Outside of two-factor authetication, I find most security themes don't really make you any more secure but it sure gets a lot more annoying.
Now of course there are better ways to do security (two-factor authentication being the most common ones), but I think secret questions are the least secure way to do it. I know my friends all know each other's secret questions if they actually picked an answer that's true as opposed to just using the secret question as another password field. After all if your secret question is 'where were you born' there really is only one correct answer to that assuming you're not lying, and this information isn't too hard to find or even guess. Another thing I noticed is that answer to these secret question are case sensitive, even though some of them can be answered as a phrase. So if the answer to your secret question is 'a and b', you could come back a few year later and not sure if you typed 'b and a' or 'A and b' or 'B and a' or 'B and A' or 'A and B', or even 'a/b'. I find that to produce answers that are even halfway reliable I'd have to write them down, and if I have to write stuff down I can also produce perfectly secure passwords too, and of course writing anything down kind of defeats the purpose of being secure in the first place.
Although security isn't easy, if you just say ignore problems where any strength password would be irrelevent (phishing, keylogger, etc), then I think this is a solved problem with well-known ways to make it practically impossible to beat by brute force. I understand security guys want to make stuff foolproof, but as someone said before, fools can be very resourceful. Outside of two-factor authetication, I find most security themes don't really make you any more secure but it sure gets a lot more annoying.
