Q

Authentication via a series of questions

My project is to write a program that would ask a user a few random questions that only the user would know. The purpose of this project is to find out if there is a way to authenticate a user without using a sometimes complicated and hard to remember password. In some cases, users have multiple passwords for multiple systems, etc. I would like to see if it is possible for a computer to recognize a user based on the answers to the questions...

posed.

I'm wondering if, to your knowledge, anything like this has been done before. And, I'm also wondering if you can suggest any resources for me to look at for finding out more information about using questions to authenticate a user. Any other comments/suggestions/feedback would be immensely appreciated!


Sure, you can do this.

If truth be told, when I was a college student, I wrote an authentication system that worked by asking someone a number of questions that presumably only that person could know. It was clever and also had the benefit of a sense of humor -- after all, who can resist making the library of questions include, "What is your quest?" "What is your favorite color?" and the ever-popular "What is the capital of Assyria?" (for which there are at least two answers.)

There are a number of other places that similar mechanisms are used. For example, I'm a member of the Apple Developers' Program. If you forget your password on that, they ask you a series of authentication questions before letting you get back into your account.

In PGP, we have a way that you can reconstruct your key with a series of questions. It uses Blakely-Shamir key-splitting.

M-Tech has a question system for getting back a Windows password.

There are a number of issues associated with this sort of authentication. I use the word issue because they aren't problems, they're just things you have to keep track of.

Here's an example: Imagine that someone was born in San Francisco and wants to use that fact in one of their authentication questions. Here are accurate answers to "Where were you born?"

  • California
  • CA
  • San Francisco
  • San Francisco, California
  • Fog City
  • Frisco
  • SF
  • 94014

We have accurate but vague (California and CA), to specific, to whimsical (Fog City). The use of a ZIP code (94014) is also clever, especially as this is actually a ZIP code in Daly City.

The two issues are how do I, as a user, remember which one I put in, and how does the computer disambiguate. Should the computer consider either "San Francisco" or "SF" to be the same?

Also consider the threat model. Is this supposed to thwart accidental, casual or determined attacks? Thanks to the magic of the Internet, it's relatively easy to find out where someone was born. Thus, one gets more security from whimsical answers, but what happens if you forgot you used "Fog City" or "Home of the Niners"?

There's another issue in figuring out the value of a question and an answer. How do you measure the worth of "what is your favorite color" versus "what's your mother's maiden name"?

I hope this helps you think about it.


For more information on this topic, visit these other SearchSecurity.com resources:
  • Best Web Links: Authentication/Access Control
  • Best Web Links: Passwords/Authentication
  • Executive Security Briefing: Problems with authentication


  • This was first published in March 2003

    Dig deeper on Disk Encryption and File Encryption

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    -ADS BY GOOGLE

    SearchCloudSecurity

    SearchNetworking

    SearchCIO

    SearchConsumerization

    SearchEnterpriseDesktop

    SearchCloudComputing

    ComputerWeekly

    Close