{ "_description": "Generated from data/ — edit the sources, not this file. The agent access guide explains the evidence boundary of every field.", "schemaVersion": "1.0.0", "kind": "entry", "locale": "en", "id": "security-questions", "name": { "zh": "安全问题", "en": "Security Questions" }, "page": "https://designvocabulary.com/en/entries/security-questions/", "self": "https://designvocabulary.com/en/entries/security-questions.json", "alternates": { "zh-CN": "https://designvocabulary.com/zh/entries/security-questions.json", "en": "https://designvocabulary.com/en/entries/security-questions.json" }, "site": { "catalogSchemaVersion": "0.1.0", "entries": 137, "index": "https://designvocabulary.com/en/entries/index.json", "query": "https://designvocabulary.com/api/query?lang=en", "guide": "https://designvocabulary.com/en/agents/", "llms": "https://designvocabulary.com/llms.txt" }, "provenance": { "sourceBacked": [ "entry.definition" ], "editorial": [ "entry.boundary", "entry.signature", "entry.when", "entry.when_not", "entry.tradeoff", "entry.comparison", "entry.rules", "entry.relations", "entry.implementationNote", "entry.anti" ], "scope": "Definitions reference these sources. Digital specimens, selection advice, relationships, and recipes are editorial work and have not been validated through user research.", "editorialStatus": "drafted", "specimenData": "fictional", "specimenNote": "Original fictional specimens. Definitions cite sources; usage advice and recipes are editorial.", "sources": [ { "id": "securityq-nist-63b", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "title": "NIST SP 800-63B-4 · Digital Identity Guidelines: Authentication and Authenticator Management", "checkedAt": "2026-09-16", "archive": { "status": "pending", "confirmed": false, "url": null, "capturedAt": null, "lookupUrl": "https://web.archive.org/web/20260916*/https://pages.nist.gov/800-63-4/sp800-63b.html" } }, { "id": "securityq-wikipedia", "url": "https://en.wikipedia.org/wiki/Security_question", "title": "Wikipedia · Security question", "checkedAt": "2026-09-16", "archive": { "status": "available", "confirmed": true, "url": "https://web.archive.org/web/20260922115835/https://en.wikipedia.org/wiki/Security_question", "capturedAt": "2026-09-22T11:58:35Z", "lookupUrl": "https://web.archive.org/web/20260916*/https://en.wikipedia.org/wiki/Security_question" } } ], "lists": [], "ordered": false, "listDisclaimer": "Seat numbers are editorial positions, not scores, rankings, or popularity measurements. A list that is not filled is left as it is." }, "entry": { "id": "security-questions", "type": "anti", "name": { "zh": "安全问题", "en": "Security Questions" }, "aliases": [ "Knowledge-Based Authentication", "KBA", "密保问题", "知识型验证" ], "granularity": "flow", "intents": [ "audit-choice", "prevent-error" ], "tags": [ "anti-pattern", "authentication", "account recovery", "shared secret", "guessable" ], "definition": "Treating questions about a person’s life — a mother’s maiden name, a first pet’s name — as an authentication credential: the user answers at sign-up and later uses those answers to sign in or recover the account. It is presented as a supplement to a password and is in fact a weaker one.", "boundary": "This entry targets using knowledge questions as an authentication or account-recovery credential, not a support agent asking questions on a call to help confirm who they are speaking to. What makes it an anti-pattern is not that the questions were badly chosen — a different list does not resolve the underlying tension: the easier an answer is to remember, the easier it is for someone else to look up, and the harder it is to look up, the more likely the owner is to forget it. This entry therefore offers no list of better questions, which would only move the same problem. It is a warning entry, not a recommendation.", "signature": [ "Sign-up asks the user to pick questions from a fixed list and answer them", "The answers are facts about a life rather than a secret the user generated", "The answers are used to bypass the password and become another way into the account" ], "when": [ "Auditing which knowledge questions remain in an existing sign-in or recovery flow", "Assessing whether a vendor’s authentication offering still depends on this mechanism" ], "when_not": [ "As the authentication or account-recovery mechanism of a new product", "Fixing it by swapping in harder-to-guess questions, which leaves the structure unchanged" ], "tradeoff": "The repair is to move recovery to something the person holds — a one-time code sent to a verified address or number, a recovery code, a passkey, or an identity provider; where human recovery must remain, hand it to a logged, auditable process rather than to a question whose answer anyone can look up on social media.", "comparison": { "focus": "Using facts about a life as an authentication credential", "mechanism": "Answered at sign-up and later used to bypass the password", "cost": "A memorable answer can be looked up and an unfindable one is forgotten" }, "sources": [ { "id": "securityq-nist-63b", "title": "NIST SP 800-63B-4 · Digital Identity Guidelines: Authentication and Authenticator Management", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html", "claim": "The guideline states that verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA, for example “What was the name of your first pet?”) or security questions when choosing passwords. It also lists the authentication types available at AAL1 — password, look-up secret, out-of-band device, single-factor and multi-factor one-time passwords, and single-factor and multi-factor cryptographic authentication — and knowledge-based authentication is not among them. This entry takes the current guidance from it, keeping the SHALL NOT scoped to choosing passwords as the source words it.", "checkedAt": "2026-09-16", "archive": { "lookupUrl": "https://web.archive.org/web/20260916*/https://pages.nist.gov/800-63-4/sp800-63b.html", "status": "pending", "checkedAt": "2026-09-16T17:41:39.282Z", "error": "status-request-failed", "jobId": "spn2-ccdd5ba23b7cae0e10267de60c13f2fb412e4dab" } }, { "id": "securityq-wikipedia", "title": "Wikipedia · Security question", "url": "https://en.wikipedia.org/wiki/Security_question", "claim": "The article describes a security question as a form of shared secret used as an authenticator and records the criticism of it: taking the questions online exposes them to keystroke logging, brute-force guessing, and phishing; computers are less able than a human agent to cope with inexact answers, so users must remember exact spelling and sometimes case and are more likely to write answers down; and it quotes Bruce Schneier that because these are public facts about a person they are easier for attackers to guess than passwords, while users who know this invent fake answers and then forget them, defeating the purpose and creating an inconvenience not worth the investment. This entry takes its statement of the dilemma from this.", "checkedAt": "2026-09-16", "archive": { "lookupUrl": "https://web.archive.org/web/20260916*/https://en.wikipedia.org/wiki/Security_question", "status": "available", "checkedAt": "2026-09-22T11:58:11.418Z", "jobId": "spn2-24d73cacfa84a72e78abdfaa2bcd6273376b01e2", "url": "https://web.archive.org/web/20260922115835/https://en.wikipedia.org/wiki/Security_question", "timestamp": "20260922115835" } } ], "relations": [ { "target": "single-sign-on", "kind": "alternative", "condition": "The product needs a path for account recovery or re-authentication", "reason": "Handing authentication and recovery back to an identity provider is more reliable than every product keeping its own set of guessable questions, and easier to revoke centrally.", "basis": "editorial" }, { "target": "error-prevention", "kind": "misused_as", "condition": "Security questions are sold as one more safeguard", "reason": "It looks like an added layer but opens a weaker way in, and an account is only as secure as its weakest path.", "basis": "editorial" }, { "target": "privacy-by-design", "kind": "conflicts_when", "condition": "The product stores facts about a user’s life for this purpose over the long term", "reason": "The answers are sensitive personal data that cannot be rotated once leaked: nobody can change their birthplace or their mother’s maiden name.", "basis": "editorial" } ], "rules": [ { "when": "An existing product still uses security questions to authenticate or recover", "instruction": "Remove it from the authentication path, move recovery to something the person holds, and delete the stored answers along with it.", "strength": "must", "basis": "editorial" }, { "when": "Compliance or a vendor makes removing it impossible in the short term", "instruction": "Do not treat it as a factor on its own, and tell users plainly that these answers are stored and for how long.", "strength": "recommend", "basis": "editorial" } ], "anti": { "harm": "It opens a path around the password that is easier to look up or to forget, lowering real account security while storing personal facts that can never be rotated", "repair": "Move to one-time codes sent to a verified channel, recovery codes, passkeys, or an identity provider; where human recovery is genuinely needed, use a logged and auditable process, and delete the stored questions and answers." }, "demo": null, "version": "0.1.0", "editorialStatus": "drafted", "requirements": [], "demoCapabilities": [], "implementationNote": "This is a warning entry and not a recommendation; the illustration is an editorial sketch whose questions and answers are invented and represent no real product. When auditing an existing product, also check whether support staff still treat the same answers as proof of identity.", "image": { "src": "/images/security-questions.webp", "alt": "A sketch: a fictional sign-up form listing three rows of dropdown security questions with answer fields beside them, and to the right a magnifying-glass icon pointing at a social feed to show the same answers can be found in public information, with a crossed-out run of grey placeholder text beneath the form." }, "searchTerms": [ "反模式", "身份验证", "账户恢复", "共享秘密", "可猜测" ] } }