Yahoo uses a common password-recovery mechanism for those who forgot their passwords: a series of personal questions...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
to determine the user's identity. In the Sarah Palin case, the three questions were:
- What is your ZIP code?
- What is your birthday?
- Where did you meet your spouse?
Unfortunately for Palin, as a public figure, this information is readily available. Her birthdate is in the first line of her Wikipedia entry. That same entry reveals that she currently lives in Wasilla, Alaska. A quick search of the United States Postal Service website reveals that there is only one ZIP code for street addresses in Wasilla.
The third question is a little trickier and required some guesswork. Her Wikipedia entry notes that her husband Todd is her "childhood sweetheart." It also adds that she attended Wasilla High School. Combine those two facts with a little inference, and you get the answer to the final question: she met her spouse at Wasilla High School.
So what does this mean for the enterprise? If you're running any type of service that allows end-users to retrieve forgotten passwords, now is a good time to look at the security of that service. Are you asking easily guessed (or researched) personal questions? If so, rethink your approach. At the very least, choose stronger, more obscure questions, such as "What was your favorite sandwich as a child?" or "Where did you purchase/adopt your first pet?" Alternatively, if you're willing to make an investment in this area, you might consider using a third-party identity-verification service that asks the user questions based upon pulling his or her credit report.
Dig Deeper on Password Management and Policy
Related Q&A from Mike Chapple
Vulnerability scanning tools are necessary to be fully compliant with PCI DSS, but the tools need to come from a PCI DSS Approved Scanning Vendor. ...continue reading
Healthcare clearinghouses like Mass HIway are a new trend in health IT, but what are the security implications? Expert Mike Chapple explains what you...continue reading
The FFIEC Cybersecurity Assessment Tool has faced harsh criticism since its 2015 release. Expert Mike Chapple reviews the tool and how it can be ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.