Would a real person on the other end accept this answer or escalate?

The purpose of insecurity questions and answers is to bypass not knowing the password. The more they’re treated like passwords, the more useless they become for that purpose.

Insecurity questions are those questions you’re forced to answer when you create an account just in case you forget your password. The answers are about some aspect of your life. Your mother’s maiden name. Your first date. Your most inspirational teacher. Your favorite actor.¹ Public information that is hopefully obscure enough to identify you in the unlikely event that you forget your password, but at the same time keeping the mass of potential hijackers out.

Insecurity questions are sometimes called security questions, secret questions, out-of-wallet questions², or knowledge-based authentication. These questions by their nature require awkward security tradeoffs. Sometimes I think the reason password recovery questions are referred to with misleading names like “security questions” and “secret questions” is to gloss over the fact that they are horribly insecure, not at all secret, and do little to ensure authentication. The questions aren’t secret. They’re shown to anyone attempting to bypass not knowing the password. The answers aren’t secret. That’s the whole point, that they are information about a person that the person won’t, like their password, forget.

Calling them security questions obscures the fact that they specifically reduce security. That’s their entire purpose: to provide alternative access to a protected service, in a way that doesn’t require knowing the account owner’s access credentials. The more avenues we provide for accessing a protected service without knowing or having the pass information, the easier it is for the hijacker. Two different access paths will always be less secure then one path, even if both paths are secure—and insecurity questions are by design not secure. That’s their whole point, that you’ve lost access to the secure path.³

It’s a lot like the old mystery schtick about only criminals having alibis. Who knows they’re going to need an alibi for 9 pm on Thursday night? The criminal who planned a crime for 9 pm on Thursday. The mass of people innocent of the crime have no idea they need an alibi, and apply no resources to creating one.

Most users don’t forget their password, and so will never have to go through the alternative access path. But the insecurity questions remain available to hijackers regardless. And because their entire purpose is to bypass not knowing the password, insecurity questions and their answers cannot be treated like passwords. This makes them perfect for hijacking an account.

And this leads into the second major issue that makes insecurity questions so problematic. They use information that is personal to the user and so is known by other people close to the user. These are the pool of people that hijackers with a grudge come from. The abusive ex-husband or ex-boyfriend, the shady relative, the ex-friend with an ax to grind, the friend-of-a-friend who decides to target them because they think it’s easy money. These are also the people most likely to know the answers to insecurity questions. As friends or friends of friends, they likely have access to their target’s social media. Insecurity questions are the same questions that show up on Facebook polls all the time: Name your favorite album. Your porn name is your first childhood pet plus the name of the street you grew up on. What car did you learn to drive on? What was your first job?

Not to mention what happens when a site gets hacked and their database of insecurity questions stolen. The whole point of these questions is that the answers are the same everywhere, that the user knows the answer because it is something about them. When a password is compromised, we tell people to choose a different password. What do we tell them if their insecurity question answers are compromised? Choose a new favorite teacher? Change where they went on their honeymoon?

But even without hacks, as friends or friends of friends hijackers with a grudge can also acquire this information through normal conversation.

The third major issue, and the one which stymies attempts to make insecurity questions more secure, is that the answers to these questions are ephemeral. They are questions with real answers, and those answers can and do change over time. Favorites change; inspirations change. A person’s knowledge of their past changes over time. Even the way someone spells words or refers to the same person, place, event, or thing, changes over time. And this usually happens without our even realizing it.

This means that insecurity questions are only really useful if they are available in plaintext for both ends to see: to display to the user when they log in with their password, so that they can update their answers when the answers become wrong; and to display to the tech support person who can view the answers and realize that if you were born in Maplewood you were also born in St. Louis. Or that if your favorite rapper is listed as Puff Daddy, answering P Diddy is a correct answer and that Spider-Man and Spiderman are the same superhero.

These are real things⁴, and real things can be referred to in different ways.

Securing the answers as if they were passwords hides this⁵, and by hiding it destroys the reason these questions were asked to begin with: to provide questions that the unprepared user can answer in order to gain access to their account. If the answers are secured as if they were passwords, no ambiguity is allowed in answering them, and they become for all practical purposes useless—except for account hijackers. The way that valid users respond to not knowing the password and the way that account hijackers respond to not knowing the password are very different. Hijackers can afford to be patient. They can wait weeks to find a way in. The benefit to them is the same whether they get in immediately or in a year. This is not true of the account owner, who needs to access the service now.

Of course, this sort of ambiguity also plays into social engineering attacks, since many of these questions have a limited number of likely answers.

Insecurity questions are designed to bypass not knowing a password. This is a trait shared both by the user who has forgotten their password (or lost some other access credential) and by anyone who wants to hijack the account and never knew the password. By their nature insecurity questions provide access to the account both to the forgetful and to the criminal.

If we hashed⁵ the answers to security questions, required users to choose strong answers, and didn’t allow them to use easily-guessable answers, then there would be no point to them. They will always be insecure, and they will always be dangerous.