Hate is a strong word.
But there’s a certain feeling I get in my body whenever I’m signing up for a website
and they start asking me personal questions like, “What’s your first pet’s name?”
“What’s your elementary school?”, “What’s your mother’s maiden name?”.
“What city were you born in?”
And it doesn’t happen as often these days, but it still happens, and whenever it does
there’s that security bone inside of me that gets kinda nervous.
Because…
it’s just not very secure.
These are what we begrudgingly call security questions.
Or sometimes referred to as Secret Questions.
And they were primarily used in the past oftentimes as an account recovery option.
So like if you forgot your password, (“oh no my password”), they would ask you a bunch
of personal questions and if you could answer all of them, you’d be all set.
But there’s a lot of problems with this, centered around this theme of being neither
secret nor secure.
First and foremost, all of these questions are actually not that secret.
Like, what’s your first pet’s name?
Are you serious?
I talk about my pets all the time!
So it’s very concerning to me when these sites give me the option to choose “Father’s
Name” as an appropriate secret question.
AS I WAS WRITING THIS SCRIPT, I was asked to create an account with that as a potential
security question.
So anyone who knows me at all, or you know, knows how to do a quick Google search can
find out a lot of this information without too much of a struggle.
But even if you knew nothing about a person, and I don’t know, were just too lazy to
do a quick social media search to break into an account, these questions aren’t particularly
varied in their answers either.
Like, let’s talk about City You were Born In or City You First Lived In.
Like, let’s say I know you live in the United States, and that’s the only thing I know
about you.
Turns out, there’s an 8% chance you live in one of these 10 cities.
Which means 8% of the time, I’m gonna be able to guess these answers within 10 tries!
This becomes even more extreme in certain other areas.
If I know you live in Japan, there’s an 11% chance you live in Tokyo.
First try, 11% of accounts are compromised.
If I know you live in Korea, there’s a 19% chance that you live in Seoul.
So that means, this question, if I have ONE GUESS, almost 1 in 5 OF YOU HAVE THE SAME
ANSWER.
Sames goes with questions like Last Names or Favorite food, depending on your language
or culture, these questions might have a far lower variability than you should be comfortable
with.
Like a randomly generated 8 digit password has quadrillions of possible values, but the
model of your first car?
There’s not that many kinds of cars.
If everyone on the planet right now decided to design and build a thousand different models
of cars, it still wouldn’t even be close.
So why do websites even do security questions?
Well, supposedly it’s a question that people will remember for their entire lives because
it’s fundamental to them and will never change.
This also happens to be its primary weakness!
Like if it never changes that means unlike a password, if it leaks once, it’s insecure
forever.
Or you know, if you post something on social media once, it’s insecure!
I mean, have you ever told anyone your dad’s first name?
INSECURE!
And also, that means that it’s going to be the same value for every single site you
use it for!
You know, exactly the opposite of what we expect a good password to look like!
But also, sometimes they ask questions that do change!
Like, what’s your favorite food, or your favorite superhero?
Then you gotta think back to when you were 13 and made that account and think, “huh,
what would 13 year old me say is their favorite food?”
Funnily enough, what a handful of people do is that they make up an answer to try and
make it harder to guess, or sometimes easier to remember, but also sometimes it just has
the opposite effect because you forgot what your fake answer was.
Which is a pain.
So what I like to do, is generate basically a second password and store it in my password
manager or key vault, but it’s not like a lot of password managers have slots for
you to input two passwords, so I gotta figure out how to make like a secure note or something,
it’s a whole thing, it’s a pain, whatever.
And yeah, other methods of authentication can be a pain too, like two factor authentication
becomes pretty difficult if you lose your phone, but just my opinion, I have a password
manager, I have my two factor, and if I never have to see another poor security question
again, I’ll be pretty happy.
Alright, video over!
Click away if you want.
I just wanted to let you know, that this last month and half ish has been absolutely wild.
I have been in the process of quitting one job, applying to all sorts of places, onboarding
onto another job, living on my floor, moving across the country, trying to find an apartment,
all while trying to make this video without any of my equipment, my computer, desk and
chair, my mic, my assets, all that.
And I’m just so glad I was able to scrape together this video with my scuffed setup.
You may have noticed that the last few videos have been a little shorter.
But I wanted to put something out, because I’m so grateful for the support of this
channel the past few months.
It’s been so chaotic around here, but my viewers, especially my Patreon supporters
are so wonderful, I needed to put something out there.
When I get all my stuff back, we’ll be sure to have the proper credits and everything,
but please excuse our appearances for the time being, and thank you so much for the
support!
If you’d like to join them, link to my Patreon is in the description.
Again, apologies for the somewhat scuffed videos, hopefully we’ll be up and running
soon!