• Tasks for the weekend – July 17 – what’s your password?

    (Youtube here)

    Just the other day I was reminded to be careful with any of the social media “game” questions that try to make you build a name from various information you provide. What these are doing it trying to get you to expose your security password reset answers…. typical password reset questions include:

    What Is your favorite book?
    What is the name of the road you grew up on?
    What is your mother’s maiden name?
    What was the name of your first/current/favorite pet?
    What was the first company that you worked for?
    Where did you meet your spouse?
    Where did you go to high school/college?
    What is your favorite food?
    What city were you born in?
    Where is your favorite place to vacation?

    As a study indicated, “All four of the most popular webmail providers – AOL, Google, Microsoft, and Yahoo! – rely on personal questions as the secondary authentication secrets used to reset account passwords. The security of these questions has received limited formal scrutiny, almost all of which predates webmail. We ran a user study to measure the reliability and security of the questions used by all four webmail providers. We asked participants to answer these questions and then asked their acquaintances to guess their answers. Acquaintances with whom participants reported being unwilling to share their webmail passwords were able to guess 17% of their answers. Participants forgot 20% of their own answers within six months. What’s more, 13% of answers could be guessed within five attempts by guessing the most popular answers of other participants, though this weakness is partially attributable to the geographic homogeneity of our participant pool.”

    Bottom line be careful when social media games try to get information from you, they may be trying to trick you. And next time you pick a password reset answer, try NOT to pick the usual stuff.