Like it or not, security question password reset isn’t going away. Most organizations find it to be a cost effective approach that seems to work in practice. While there are many problems with this approach, one has received little attention: how to safely store the answers. I show that common methods used for storing password validation information are not suitable for security questions, and propose better alternatives.
Arnold Reinhold has been involved with password and passphrase security since the mid-1990s. He is the developer of Diceware, RockSalt, CipherSaber and HEKS, the first password hash designed to consume memory resources as well as CPU time. He has worked on spacecraft navigation at NASA, apparel industry automation at Marcon, computer-aided design software at Computervision Corp. and helped found Automatix Inc., an early robotics and machine vision company. Mr. Reinhold is co-author of several For Dummies books, including The Internet For Dummies Quick Reference and Email For Dummies, and contributes regularly to Wikipedia. Mr. Reinhold studied mathematics at MIT and management at Harvard.