'Secret' Questions Leave Accounts Vulnerable

[RamboLiberal]

What's your secret question? Your mother's maiden name? Your first pet? For many people, facts like these are all that protect their email and other accounts should they forget their password.

Now a new study by researchers at Microsoft Research in Redmond, Wash. reveals just how easy the answers of such security questions are for other people to guess.

Acquaintances of 32 Web mail users – people with whom they would not normally share their login details – were asked to try and guess the answers users assigned to protect their accounts. The volunteers managed to guess correctly nearly a fifth of the time, raising questions over how secure the commonly used system is.

However, a second Microsoft study suggests a more secure alternative: relying on trusted friends to vouch for you if an account becomes locked.

Securing webmail is important because email accounts typically allow an attacker access to other accounts, for example, eBay and Amazon, points out Ross Anderson, a security engineer from Cambridge University, UK, because it is possible to request password reminders that will be sent to the compromised account.

http://abcnews.go.com/Technology/story?id=7909889&page=1

And what if you're kind of a loner without a bunch of "trusted friends"? Personally they need to pick better secret questions and users need to pick better passwords. And don't use the same password on multiple accounts.

Heck, I've already had trouble providing the answer to my own secret questions. Some of the more offbeat ones like what is your favorite TV character have tripped me up.