Choosing and Using Security Questions Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T13:56:54Z

Point to the official site

2019-02-13T09:25:27Z

Migration to GitHub

2018-08-31T18:23:55Z

Fix minor typo in Desired Characteristics section.

2017-09-11T05:59:15Z

‎Other Cheatsheets

2016-05-18T11:15:26Z

‎Security Questions As An Additional Means Of Authenticating

2015-07-18T23:06:47Z

moving navigation to bottom for mobile friendlness

2015-06-11T21:49:31Z

‎Other Cheatsheets

2015-05-23T22:51:22Z

‎Security Questions As An Additional Means Of Authenticating: - corrected unintended implication

2014-04-17T22:32:20Z

2014-04-08T03:10:18Z

← Older revision		Revision as of 13:56, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.md Choosing and Using Security Questions Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html Choosing and Using Security Questions Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 31: / Line 31: @@
 # '''Memorable''': If users can't remember their answers to their security questions, you have achieved nothing.
 # '''Consistent''': The user's answers should not change over time. For instance, asking "What is the name of your significant other?" may have a different answer 5 years from now.
-# '''Nearly universal''': The security questions should apply to a wide an audience of possible.
+# '''Nearly universal''': The security questions should apply to as wide an audience as possible.
 # '''Safe''': The answers to security questions should not be something that is easily guessed, or research (e.g., something that is matter of public record).

@@ Line 128: / Line 128: @@
 Kevin Wall - kevin.w.wall[at]gmail com
-== Other Cheatsheets ==
+= Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}

@@ Line 113: / Line 113: @@
 === Security Questions As An Additional Means Of Authenticating ===
-First, it bears repeating again...if passwords are considered weak authentication, than using security questions are even less robust. Furthermore, they are no substitute for true multi-factor authentication, or stronger forms of authentication such as authentication using one-time passwords or involving side-channel communications. In a word, very little is gained by using security questions in this context.  But, if you must...keep these things in mind:
+First, it bears repeating again...if passwords are considered weak authentication, then using security questions are even less robust. Furthermore, they are no substitute for true multi-factor authentication, or stronger forms of authentication such as authentication using one-time passwords or involving side-channel communications. In a word, very little is gained by using security questions in this context.  But, if you must...keep these things in mind:
 * Display the security question(s) on a separate page only ''after'' your users have successfully authenticated with their usernames / passwords (rather than only after they have entered their username). In this manner, you at least do not allow an adversary to view and research the security questions unless they also know the user's current password.

← Older revision		Revision as of 23:06, 18 July 2015
Line 127:		Line 127:

	Kevin Wall - kevin.w.wall[at]gmail com		Kevin Wall - kevin.w.wall[at]gmail com
−	~~\| valign="top" style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" \|~~

	== Other Cheatsheets ==		== Other Cheatsheets ==

@@ Line 16: / Line 16: @@
 = Choosing Security Questions and/or Identity Data =
-Most of us can instantly spot a bad &quot;security question&quot; when we see one. You know the ones we mean. Ones like "What is your favorite color?" are obviously bad. But as the [[http://goodsecurityquestions.com/ Good Security Questions]] web site rightly points out,
+Most of us can instantly spot a bad &quot;security question&quot; when we see one. You know the ones we mean. Ones like "What is your favorite color?" are obviously bad. But as the [http://goodsecurityquestions.com/ Good Security Questions] web site rightly points out,
 &quot;there really are NO GOOD security questions; only fair or bad questions&quot;.

@@ Line 4: / Line 4: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 | valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
 = Introduction  =
 This cheat sheet provides some best practice for developers to follow when choosing and using security questions to implement a &quot;forgot password&quot; web application feature.<br>