Pet names, elementary school, football team, favorite band… the pattern of "security questions" is very evident. What is presented in theory as a valuable resource to increase the security of an account can become a very attractive attack vector if the user does not take the necessary precautions. Google analyzed hundreds of millions of questions, and its conclusion exposes a fundamental flaw: the answers are too easy, or impossible to remember.
A Flawed Defense
It is useless to have a strong password if the answer to the security question can be guessed in a matter of minutes. Unfortunately, there are many services on the Web that do not pay enough attention to this point. In some cases, the list of questions is so limited and vulnerable that it harms the user instead of protecting them. From a technical point of view, anyone who does not want the responsibility of remembering the answer to that question can "put a plug" with something impossible to remember. Google's latest study considers this a problem, and we agree, but it is preferable to leaving a back door unlocked.
What the Numbers Say
Google's numbers teach us the following: In the case of too simple answers, the attacker has a 19.7 percent probability of entering the account of an English-speaking user on the first attempt, if that user chooses "pizza" as the answer to their favorite food. With ten attempts in favor, there is a 21 percent probability of guessing the "father's middle name" of Spanish-speaking users, and 39 percent to discover the city of birth among Korean users. On the other side, 40 percent of English-speaking users were unable to remember the answer to their question, even though those same users managed to memorize reset codes sent by SMS between 75 and 80 percent of the time.
Better Options
Google believes that the security question should be used as a last resort, and that sending codes via SMS is a much safer option. The Mountain View giant is not wrong about this, however, there are two problems: the service provider must have our phone number, and mobile devices can be stolen. I am convinced that any user has the imagination to invent a secret question and an answer that is easy to remember. Something absurd, capable of causing laughter, or even an insult. Creativity and chaos are your allies here. If you want to verify the security question on your Google account, you can click here.
