Beginner LevelAuthentication & Authorization
Why are Security Questions considered insecure compared to TOTP or Hardware Security Keys?
❓ Interview Prompt: Explain vulnerabilities of Knowledge-Based Authentication (KBA), social engineering, public OSINT data, and modern alternatives.
Legacy Knowledge-Based Authentication (KBA) (e.g. "What is your mother's maiden name?" or "What was your first pet's name?") is widely considered insecure by NIST security standards.
Vulnerabilities of Security Questions:
1
Public OSINT Exposure: Answers are frequently discoverable via public social media profiles (LinkedIn, Facebook, ancestry sites).
2
Low Entropy & Predictability: Common answers (e.g. "Fluffy" or "Smith") can be easily dictionary-attacked.
3
Phishing & Social Engineering: Attackers can trick users or support staff into answering KBA questions.
Modern Superior Alternatives:
TOTP Authenticator Apps (Google Authenticator) and Hardware Keys (Passkeys/FIDO2) rely on dynamic cryptographic keys, rendering social engineering ineffective.
Code Implementation Example
typescript
// NIST Auth Guidelines Recommendation Comparison
const authFactorSecurityScores = {
'Security Questions (KBA)': { score: 'DEPRECATED', reason: 'Vulnerable to OSINT & Social Engineering' },
'SMS OTP': { score: 'WEAK', reason: 'Vulnerable to SIM Swapping' },
'TOTP Authenticator App': { score: 'STRONG', reason: 'Time-based dynamic secret key' },
'FIDO2 / Passkeys': { score: 'MAXIMUM', reason: 'Hardware cryptographic phishing resistance' }
};💡NIST authentication factor security scoring comparison.
🎯 Interview Key Takeaway
Security questions are insecure due to public OSINT exposure; replace KBA with dynamic TOTP or hardware Passkeys.
#Security Questions#KBA#MFA#NIST#Beginner
Back to all Authentication & Authorization Questions→