further adventures in security questions

[redbird]

I logged in to the TIAA-CREF website today (my retirement funds are with them, because my former employer somehow qualified as an academic institution), and they wanted me to update my security profile.

That turned out to include adding security questions. The list of options this time includes, along with things that seem too easy to look up, and things that don't apply (I didn't go to the prom), several to which my reaction was "I don't know…" I could ask my mother for my maternal grandmother's middle name; I'm not sure there's any way to find out what city my paternal grandmother was born in. What country, maybe (she was born in Russia, before the revolution, and I think my father said it was Ukrainian, but we had that conversation when it would have been the Ukrainian SSR].

Still, I found some I could answer without making up something random and writing it down in the list of passwords (the software would let me put "How-would-I-know" for my grandmother's middle name, and might have accepted "pi=3.141592," but then I would need to remember having said that), and maybe I'll ask my mother for her mother's middle name the next time we talk.

Comments

[switterbeet]

Really the ideal solution is letting users define their own security questions - I am not sure why this is not a more common thing!

[redbird]

Nor am I, unless they're worried that a lot of people would pick questions that are even easier to answer than what's being used now: "where do you live?" rather than my credit union's "where does your closest sibling live?"

My ISP asked me to give them a question and answer; I've never needed it, because they aren't into random challenges at login, but it does a good job of not being something that random strangers could look up (unlike, say, what city I was born in).

[ellarien]

Security questions are an utter pain. I met one once where there were three questions, all compulsory, all hopelessly vague. ("Who was your inspirational figure as a child?") Another time I couldn't remember exactly how I'd punctuated my hometown. And my mother had terrible trouble when the security question for an email account my brother-in-law had set up for her turned out to be "What is your favourite breed of dog?" and, not being a dog person, she had no idea what she might have answered. We never did figure that one out, but we did eventually get into the account by pleading with customer support.

[cartesiandaemon.livejournal.com]

Eesh :(

Are these security questions in *addition* to the normal security, or *instead* of the normal security?

Can you write down somewhere safe but not necessarily secure, "Grandmother's maiden name = [Your own choice of security question]" (Whether that's just a normal security question you happen to like more, or a random password?)

[redbird]

These are "pick a password, give us a contact phone number please*, and pick three security questions." And yes, there are places where I have put answered "favorite cartoon characters" with "what is your favorite color" and "prom date" with "none."

I was surprised amused because usually, the "none" answers are for things where that is literally true rather than "I don't remember": my high school had no prom, and I don't have a favorite cartoon character. In this case, I had two grandmothers, and clearly they were born somewhere, I just don't know what city, only what country. (I know where my mother's parents lived when she was a small child, but if I remember the story of their courtship correctly, my grandmother moved there after they married.)