What's a good alternative to security questions? [closed]

Question

From Wired magazine:

...the Palin hack didn't require any real skill. Instead, the hacker simply reset Palin's password using her birthdate, ZIP code and information about where she met her spouse -- the security question on her Yahoo account, which was answered (Wasilla High) by a simple Google search.

We cannot trust such security questions to reset forgotten passwords.
How do you design a better system?

Answer 1

The insecurity of so-called "security questions" has been known for a long time. As Bruce Schneier puts it:

The result is the normal security protocol (passwords) falls back to a much less secure protocol (secret questions). And the security of the entire system suffers.

What can one do? My usual technique is to type a completely random answer -- I madly slap at my keyboard for a few seconds -- and then forget about it. This ensures that some attacker can't bypass my password and try to guess the answer to my secret question, but is pretty unpleasant if I forget my password. The one time this happened to me, I had to call the company to get my password and question reset. (Honestly, I don't remember how I authenticated myself to the customer service rep at the other end of the phone line.)

I think the better technique is to just send an e-mail with a link they can use to generate a new random password to the e-mail account the user originally used to register. If they didn't request a new password, they can just ignore it and keep using their old one. As others have pointed out, this wouldn't necessarily have helped Yahoo, since they were running an e-mail service, but for most other services e-mail is a decent authentication measure (in effect, you foist the authentication problem off on the user's e-mail provider).

Of course, you could just use OpenID.

Answer 2

Out-of-band communication is the way to go.

For instance, sending a temporary password in SMS may be acceptable (depending on the system). I've seen this implemented often by telecoms, where SMS is cheap/free/part of business, and the user's cellphone number is pre-registered...

Banks often require a phone call to/from a specific number, but I personally am not too crazy about that....

And of course, depending on the system, forcing the user to come in to the branch office to personally identify themselves can also work (just royally annoy the user).

Bottom line, DON'T create a weaker channel to bypass the strong password requirements.