Glide Underground

Password Resets Insecure

Articles / Personal Stuff/Random News
Date: Aug 14, 2008 - 09:32 AM
IT World's got a great bit on the insecurity of password reset questions:

When you have forgotten your password, some sites send you an email with a link for you to click. Phishers who have stolen access to your email account can do that, too. Other sites will ask you for your mother?s maiden name, the name of your best friend, what city you grew up in, or what brand your first car was. Did you know that phishers can answer those questions, too?

Like the city you grew up in, your mother?s maiden name can be derived from public records ? from birth certificates and marriage certificates to be specific. (Download PDF for details.) Facebook might unwittingly tell the name of your best friend. And,until quite recently, Ford with its 25% market share had a pretty good chance of being the brand of your first car!
An unintended consequence of "secure" password procedures - people forget their password far too often. Unfortunately, the next step might make it impossible to get a reset done!




This article is from Glide Underground
http://www.glideunderground.com/

The URL for this story is:
http://www.glideunderground.com/modules.php?op=modload&name=News&file=article&sid=3506