Despite the prevalence of security questions, their safety and effectiveness have rarely been studied in depth… We analyzed hundreds of millions of secret questions and answers that had been used for millions of account recovery claims at Google. We then worked to measure the likelihood that hackers could guess the answers.
- Common answers. One study found that about 10 percent of answers could be guessed using a list of other answers provided by users in the same study.
- Few plausible answers. Asking for your favorite superhero is one example.
- Publicly available answers. Such answers are routinely listed publicly in online social-networking profiles or public records. For example, one study found that at least 30 percent of Texas residents’ mothers’ maiden names can be deduced from birth and marriage records.
- Answers that can be obtained through email phishing. In one study, researchers used email phishing to learn answers to personal-knowledge questions from 92 percent of users.
- Answers that acquaintances can easily guess. One laboratory study found that acquaintances could correctly guess 17 percent of answers correctly within less than a half-dozen attempts.
We conclude that it appears next to impossible to find secret questions that are both secure and memorable. Secret questions continue to have some use when combined with other signals, but they should not be used alone and best practice should favor more reliable alternatives.