Almost every website with a user registration process requires that you provide answers to some “security questions” for use in situations where you forget your password. I’m sure everyone has come across at least one of the following examples:
- What is your mother’s maiden name?
- What was the name of your elementary school?
- What is your paternal grandfather’s first name?
These examples are reasonably simple and unambiguous and most importantly, have stable answers that don’t change over time. This isn’t always the case; a lot of questions used for this purpose do not have these properties:
- What is your favorite movie?
- Who is your favorite athlete?
- What is your pet’s name?
- What is the middle name of your youngest child?
The obvious (and most serious) problem with these questions is that they lack stable answers. My favorite anything can change from one day to the next. I can get a new pet. And so on. You think you’ll be able to remember what your favorite movie was at that particular time you first signed up for a website?
These questions, especially the “favorite” variety, also create a major problem for the user experience: They may require thought and reflection before settling on an answer. The registration process needs to be as fast and easy as possible (perhaps even transparent) and questions like these are like a brick wall.
Most websites provide the option to select what questions you want to use from a list. In the past, I would simply chose the ones that weren’t too problematic. What triggered this rant though, was Time Warner Cable’s online registration:
ಠ_ಠ
To quote Charles Babbage, “… I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question” questions. (shout-out to Ben K)
Of course there’s an even bigger problem at hand. These traditional questions need to be discarded if only for the security implications. In a post-Facebook world, there’s an ever-increasing percentage of users that publicly share the answers to all the example questions above and probably aren’t even aware of it.
