My project is to write a program that would ask a user a few random questions that only the user would know. The purpose of this project is to find out if there is a way to authenticate a user without using a sometimes complicated and hard to remember password. In some cases, users have multiple passwords for multiple systems, etc. I would like to see if it is possible for a computer to recognize a user based on the answers to the questions posed.
I'm wondering if, to your knowledge, anything like this has been done before. And, I'm also wondering if you can suggest any resources for me to look at for finding out more information about using questions to authenticate a user. Any other comments/suggestions/feedback would be immensely appreciated!
Sure, you can do this.
If truth be told, when I was a college student, I wrote an authentication system that worked by asking someone a number of questions that presumably only that person could know. It was clever and also had the benefit of a sense of humor -- after all, who can resist making the library of questions include, "What is your quest?" "What is your favorite color?" and the ever-popular "What is the capital of Assyria?" (for which there are at least two answers.)
There are a number of other places that similar mechanisms are used. For example, I'm a member of the Apple Developers' Program. If you forget your password on that, they ask you a series of authentication questions before letting you get back into your account.
In PGP, we have a way that you can reconstruct your key with a series of questions. It uses Blakely-Shamir key-splitting.
M-Tech has a question system for getting back a Windows password.
There are a number of issues associated with this sort of authentication. I use the word issue because they aren't problems, they're just things you have to keep track of.
Here's an example: Imagine that someone was born in San Francisco and wants to use that fact in one of their authentication questions. Here are accurate answers to "Where were you born?"
- San Francisco
- San Francisco, California
- Fog City
We have accurate but vague (California and CA), to specific, to whimsical (Fog City). The use of a ZIP code (94014) is also clever, especially as this is actually a ZIP code in Daly City.
The two issues are how do I, as a user, remember which one I put in, and how does the computer disambiguate. Should the computer consider either "San Francisco" or "SF" to be the same?
Also consider the threat model. Is this supposed to thwart accidental, casual or determined attacks? Thanks to the magic of the Internet, it's relatively easy to find out where someone was born. Thus, one gets more security from whimsical answers, but what happens if you forgot you used "Fog City" or "Home of the Niners"?
There's another issue in figuring out the value of a question and an answer. How do you measure the worth of "what is your favorite color" versus "what's your mother's maiden name"?
I hope this helps you think about it.
For more information on this topic, visit these other SearchSecurity.com resources:
This was first published in March 2003