I've always looked at security questions used to automate user password recovery with quite a bit of skepticism. What's the point of requiring strong passwords if you allow anyone to reset the password on an account by answering a (potentially inane) question? And just how many good security questions are there, and how many web sites will ask similar questions, allowing the owner of one web site to reset a user's password at another site that uses the same question? I'm pretty sure that the typical user will tend to select the same security question if it's available at multiple sites. In many web sites I've seen, the security question is clearly the weak link in the chain.
Apparently a fellow recently was indicted on charges of hacking into the Republican vice presidential nominee's Yahoo email account, by simply doing some research on the Internet to find her birthday, zip code, and the answer to her security question, "Where did you meet your spouse?" All told the attack reportedly took under an hour to complete.
Given the level of interest in Palin and other public figures, and the large amount of information about them available to the public, it makes sense that they will be some of the easiest targets for attacks like this.
Posted
Oct 09 2008, 01:09 AM
by
keith-brown