OnLine Security Gone Fuzzy

This past week, I've had to register not one, but two accounts at PearsonVue so that I can schedule my upcoming massage board exams.  I freely admit that this is because I'm a somewhat mad over-achiever who needs to cover every base, and thus I have bizarrely chosen to take both of the possible exams (which I perceive as giving me more flexibility).  Even so, it seems awfully silly to have to make two separate accounts to take two exams administered by the same company in the same room in the same building on the same day.

(and yes, I do think this is one more example of ways in which the folks setting things up don't think about end users).

I'm sure you're all familiar with the <sarcastic tone> lovely </sarcastic tone> feature that so many sites now have of asking you "security questions" - either to let you log on from an unfamiliar-to-them computer or to help you when you've forgotten your password.  PearsonVue is no exception.  They require you to answer two.

Alas, the first set of choices include a series of questions for which I have no lasting answers. Seriously.  They eventually do ask a set of questions that include some that involve actual facts that are unlikely to change -- (these are paraphrases)

• What is the name of the first company you were employed by?
• In what city did you meet your spouse/significant other?
• What is the first and last name of the best man at your wedding?

That set also included some that are not totally changeable, but that are subject to change:

• What is your dream occupation? (potentially changeable over time)
• What is your oldest sibling's nickname? (likely changeable - but also a question for which it is possible if not likely that multiple answers can be true simultaneously)
• What is your spouse's/significant other's nickname? (again, changeable, and multiple)

But the first set of questions (so you had to pick one) and some in the second set, included that old hackneyed and useless series: What is your favorite.....

• What is your favorite food?
• Who is your favorite actor/musician/artist?
• What was your favorite place to visit as a child?
• What is your favorite song?
• What is your favorite book?
• What was your most memorable gift as a child?
• Who is your favorite athlete?

The only question in that set that is not subject to change might have been "What is the name of your first toy animal?"  But our memories blur over time.  Some of us may remember a different animal at different times.  Me... I'd remember Lamby (or was it Lambie? or Lammy?) but, as you can see, I have no idea how I spelled it (or, more accurately, how I would have spelled it as a 2 year old). But would I still remember Lamby if I didn't also still have Lambie?

But it's the" favorite" questions that kill me.  I have no idea!  I like many different actors for many different reasons.  I enjoy a wide range of music, and would sit for days on end trying to narrow down a favorite.  Ditto movies and books.  With those, which I prefer RIGHT NOW depends on mood, time, recent events, etc.  And.... with time, I change and grow, and my tastes change and grow.  And the book I'm likely to like most right now is the one that is helping me grow in some way -- unless it's one that lets me take a trip down nostalgia lane.

The questions about childhood -- those also get me.  I have different memories at different times.  My favorite place to visit? at what age?  And how do I put into one word the joy I got out of going to Louisiana to visit first one and then the other set of grandparents -- people and houses so different in so many ways, and yet so equally full of love?  But wait, what about those glorious camping trips we took to Deep Springs on the Current River? And some days, it might be remembering how much fun it was to go to Papa's office, where I got to play on the HUGE chalk board as much as I wanted as long as I didn't erase any of those funny looking things called equations that were part of his work?

Sigh.

I know... concrete facts are likely to be easier for hackers to figure out, but at least they don't CHANGE over time.  And requiring answers that my brain can't hold because they're changeable just means that I'll write them down somewhere... and make them easier for someone to hack.

Why not go for our grandparent's birthdays? Or their middle names?  Those aren't as easy to learn from the outside, but are things we can remember.

 

 

Comments

[D]

I love the ones that ask for my mother's middle name. Unless you know her well, (in which case I devoutly hope you're not trying to hack my accounts, because heartbreaking...) you're never going to get there.

Anniversaries and where you went on your honeymoon are all too frequently subject to change as well, as many marry more than once.

I'm thinking about standardizing my answer to something nonsensical to the question, but easy for me to remember. What's your favorite movie? Carmel buttercream donuts. It will confound hackers any road...

[kmkat]

A bank I deal with occasionally doesn't use those questions. Instead, the user has to choose one face out of each of several groups. And then remember them until the next time she [attempts to] log in. It is impossible.