Security questions are the weakest part of your account

The problem

Security questions are meant to prove who you are if you forget your password. But the answers are often:

• Public: your hometown, the school you went to and your pet’s name are often on social media.
• Guessable: favorite color and favorite food have only a handful of likely answers.
• Shared: family members and old friends know them.

Anyone who answers them can reset your password. Attackers look up the answers, or ask for them through “fun” social media quizzes like “your band name is your first pet plus your street.”

What to do

• Make up the answers. Your first car can be “purple lighthouse.” The site does not check.
• Treat them like passwords: a different made-up answer for each site.
• Store them in your password manager, in the notes for that account, so you can find them when you need them.
• Skip those quizzes on social media that ask for the same things security questions do.
• Use better recovery options where a site offers them, such as an authenticator app or a recovery code.