INFOWORLD GRIPE LINE BY ED FOSTER Bookmark this page

 
Replying To:
Insecurity Over More Security Questions

By Ed Foster, Section The Gripelog
Posted on Fri May 04, 2007 at 12:11:55 AM PDT

With phishing scams and other forms of identity theft targeting our bank accounts, financial institutions are increasingly adding additional security checks. But one reader wonders if asking you more questions isn't just a recipe for more points of failure.


"All my online banking and credit card companies are creating three security questions which only I will have the answer to," the reader wrote. "Typically they will ask me to identify the name of my high school, the street I lived on when I was in elementary school or some other similar, seemingly obscure question. These should be easy questions to answer, and in a general way they are."

But with each company requiring its own set of security questions, remembering the precise answer starts to get more difficult. "Let's take an example like the street I lived on as a kid," the reader wrote. "When they re-ask the question to validate my security, I have to remember, did I only use lower case, or did I capitalize the first letter? Did I just type in the street name, or did I remember to put in the word 'street' at the end -- i.e. was it 'Main' or 'main' or 'Main Street' or 'Main St' or 'main street' I typed?"

"My solution is to write down the security question with the answer, so when it is re-asked, I can look up what the correct answer is," the reader wrote. "So now I have a stack of papers with my security questions and answers next to my computer. At least with my passwords, I had created a system where I could memorize them all and still have unique passwords for different sites."

The more security questions the banks ask, the less secure the reader is feeling. "Bottom line -- I find these security questions to be a false sense of protection. Anyone who really was targeting me can find the answers, and I have to keep a paper trail just to track all the correct answers. And that just increases the possibility that someone will find a way to compromise my information."

Is there a better way for financial institutions to increase security without increasing the complexity we must deal with? Let's hear your thoughts - post your comments below or write me at Foster@gripe2ed.com.

Post Comment

You are not logged in. If you don't have a user account yet, by all means go make one! If you do have one, you can post as "yourself" by filling in your nickname and password below. Otherwise, your comment will be posted as Anonymous User.

Create Account
Nickname:
Password:

Post Comment: Post your comment below and then please answer the security question. I apologize for the inconvenience, but it does help deter spammers. -- Ed Foster

Subject:
Comment:

To post your comment, please answer the following security question:
Which of the following is not a word?
Arizona, Loquat, Husky, 4uk5Xu, MG, Maryland


Allowed HTML: <A [HREF] [NAME]> <DT> <TT></TT> <OL></OL> <CITE></CITE> <CODE></CODE> <I></I> <UL></UL> <BR> <STRONG></STRONG> <BLOCKQUOTE [TYPE]></BLOCKQUOTE> <DD> <EM></EM> <P> <B></B> <LI> <DL></DL>
Menu
· create account
· faq
· search

Login
Make a new account
Username:
Password:

 HOME  NEWS  COLUMNS  BLOGS  PODCASTS  TECHNOLOGIES  TEST CENTER  EVENTS  CAREERS  IT EXEC-CONNECT   About Awards Contact Us 

Copyright © 2006, Reprints, Permissions, Licensing, IDG Network, Privacy Policy.
All Rights reserved. InfoWorld is a leading publisher of technology information and product reviews on topics including viruses,
phishing, worms, firewalls, security, servers, storage, networking, wireless, databases, and web services.

ComputerWorld :: LinuxWorld :: Network World :: CIO :: PC World :: Darwin :: CMO :: CSO
IT Careers :: JavaWorld :: Macworld :: Mac Central :: Playlist :: GamePro :: GameStar :: Gamerhelp
ITWorld Canada :: Computerwoche :: Techworld UK :: tecChannel :: IDG.se :: IDG.no :: IDG.pl

create account | faq | search