Why is nobody talking about password reset questions?
"Resetting your password via email? Ok, you also have to answer these security questions that you entered 'akjhdhksdfsdf' into when you made your account!"
or
"You've logged in from a new computer! Please try to remember what you thought your favorite band was 4 years ago. You have 3 tries remaining."
Shit people, if you want me to write this stuff down, at least tell me when I'm creating my account that you basically expect me to have 4 passwords.
We no longer support security questions as a way to access your account.
Hopefully the idiots who call themselves security experts will stop making me answer "what's my mother's maiden name".
If they really want to make it safe, one easy option would be to make the question arbitrary. Of course then average people will have no idea what to put it there.
Of course, don't put "What is Love?" with the trivial answer...
This is done by developers, not security experts. If security experts had their way, it would be equally bad but for the right reasons, ie client-side certificates or smart cards.
Calling them idiots is also wrong. Its a bad solution to a hard problem, but it works and scales and users have been trained to expect it.
"After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet. None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone."
http://www.businesswire.com/news/home/20140902006384/en/Appl...
Silly "security" questions about mothers, dogs and favorite teachers seems to be cultural to the US (and maybe Canada), why is that?
Then again, you are talking about a country where the only thing people need to steal your identity is your ... social security number. Brilliant.