Recovery must not leak answers easier to guess than the password

What it is

Knowledge-based recovery uses “mother’s maiden name, first pet, school” as the key back into the account. Those answers live in a small space and often in public records or family talk, so they are easier for someone else to guess or look up than a password the person chose. This entry opposes treating such questions as sufficient for recovery, and especially opposes showing or confirming the answers to someone who does not already hold the account. It does not cover how long a reset link lives, and not whether other sessions must be kicked after reset.

Why it happens

A password, even a flawed one, is a secret generated for this account; recovery questions ask life facts whose secrecy was never the point. Social networks, yearbooks, and public records turn answers into searchable items. Family and ex-partners have an advantage over remote attackers. If the recovery page says “incorrect” while displaying the question text, the question set is handed to an enumerator. People also pick true answers so they can remember them, or reuse the same set across sites. NIST SP 800-63B dropped knowledge questions as authenticators because of guessability and publicity, not because of a conversion percentage from one study. Mail or a verified device asks who holds a channel; life facts ask a résumé anyone can search.

Studying it

Usable-security work can let an informed party (simulating family) and a stranger attack “question + answer” recovery, compare success, and see whether question text is exposed on unauthenticated pages.

Independent variables: whether knowledge questions are used, whether questions are user-written, whether failure echoes the question, whether a verified channel is used instead. Dependent variables: informed-party recovery success, stranger online-guessing success, how many questions an unauthenticated visitor can list.

Do not invent “mother’s maiden name is guessed X percent of the time”; the literature and guidance are qualitative: public, low entropy, social-engineering friendly. Stranger guessing in the lab understates field risk, because real attackers read the target’s social accounts. If the product metric is only “recovery completion,” knowledge questions look usable while handing the account to whoever can answer—not necessarily the owner.

Where it stops holding

An internal help desk that combines an employee id with in-person checks is not an open question form on the internet. Statutory Q&A in a national identity system may be undeletable in the product, but it can still be confined to a counter rather than a remotely enumerable web page. User-written questions that allow “what is my password” or an extremely private short answer are just a password in costume, and the answer must not be visible on a support console. After knowledge questions are removed, accounts with no verified channel are harder to recover in self-serve; bind a channel at signup rather than keep a weak question as backup.

Applying it

• Do not offer knowledge questions on new accounts; on existing ones, after the next sign-in, steer people to bind mail, a device, or a passkey, and allow deleting the questions.
• Self-serve recovery should use a verified mailbox, SMS, or security key, and must not show question text or answer-correctness detail on a signed-out page.
• Human recovery should use one-time temporary credentials and dynamic facts such as existing orders, not static life questions in a support script.
• Verify: visiting recovery while signed out must not present an enumerable question list. Attempting remaining questions with the target’s public information must not reach reset. Count recoveries still completed via knowledge questions; that count should fall as the steer runs.

Related

• Within the group: H6.11.2 Reset links must expire and be single-use · H6.11.3 After reset, all existing sessions must be invalidated · H6.11.4 Recovery must not reveal whether an account exists to an unverified party
• Adjacent: H6.04 Password rules · H6.12 Multi-factor authentication
• Search terms: knowledge-based authentication · security questions · NIST SP 800-63B