i find it sad that security managers have not recognized that things like pet's names are very insecure, and even sadder that no one seems to care until it happens to them...
city of birth is actually a matter of public record, as is mother's maiden name, if someone is willing to do the search at the hall of records...
at the same time, because most people simply don't know enough to care, even the ones that allow you to select your own questions usually see the ordinary default questions...
If you ever wanted to guess someone’s security questions—things like city of birth, names of pets and mother’s maiden name—just friend them on Facebook or some other social network.
These answers to alleged security questions, which are used by financial institutions and other companies to confirm your identity, are coughed up daily and voluntarily.
According to a Harris Interactive survey commissioned by ID analytics:
- More than 24 Americans 18 years or older leave social network profiles public.
- 70 million adults share their birthplace on profiles.
- 20 million adults reveal their pets’ names.
Meanwhile, other security question answers are presented for mining everyday.
The results of this survey aren’t all that surprising. In fact, the results largely confirm the work of Alessandro Acquisti, a professor at Carnegie Mellon. In a nutshell, Acquisti found that you can predict Social Security numbers with the information folks are presenting on social networks. The paper is worth a read and the short version of Acquisti’s research can be found in an interview on Smart Planet.
