Last Tuesday, I wrote a short article about some great research that Microsoft and Carnegie Mellon University performed on how secret 'secret questions' really are. Today, I was reading Schneier on Security (amazing blog) and (finally) found a link to the full report.

Microsoft is hosting "It’s no secret: Measuring the security and reliability of authentication via ‘secret’ questions" and it is a very interesting read on how secure backup authentication is. Much of this report is rather terrifying. For example, check out this quote:

For those participants who brought partners who they would not trust with their Hotmail password, we found that these partners could still guess an alarming 17% of their answers. Many answers could be guessed without even knowing the participant. From the geographically-homogenous set of participants in our laboratory study, 13% of their answers could be guessed within five attempts using statistical guessing. For user-written question/answer pairs, we categorized roughly 25% as vulnerable to family members, friends, or coworkers and another 15% as guessable within five tries with no knowledge of the victim.

Geographically-homogenous is a mouthful, but it is important to think about. If you ask someone from Saskatchewan who their favourite sports team is, there is a very high chance that the answer will be 'the Saskatchewan Roughriders'.

The answer sounds simple, doesn't it? Pick a difficult secret answer, right? Well, the Microsoft/Carnegie Mellon report also provided some statistics about that. The researchers discovered that participants forgot 20% of their own answers within six months. When I add these statistics together, the answer seems clear - 'secret question authentication' is not very secure. The question becomes, 'what would be better?'