Security Questions Are Not Secure

As a growing abundance of our personal information is stored online, we have struggled to keep private data, well, private. Companies that hold that our information work around the clock to build more secure servers and protocols. Users are advised more and more urgently to make complicated passwords that brute-force methods cannot crack. And as one last defence against intruders, newer encryption methods make it near-impossible for hackers to read your files, even in the event of a security breach.

The most common form of hacking is repeatedly guessing at a person’s password until it finds one that works, usually referencing a dictionary of common words that the average computer user would use as his or her password. This is why members of popular websites are always advised to use numbers and letters in a password.

This growing trend of “Security Questions” has caused internet security to take a giant step backwards.  This is leaving a critical vulnerability in our online banking, email, and social networking sites. Just as with a password, a security question response can be guessed. Now, instead of one difficult to determine word, someone wanting your bank account information only needs to hack through two, guaranteed, easy ones.

Letting this new vulnerability sneak right under our noses is unacceptable. The person who invented and implemented this system has set back internet security by over a decade. Web sites need to cease this practice immediately; not force their users, themselves, to open the hole.