In fact, you could phish someone pretty easy with one of those…

1. Guess one of your “friends” bank.
2. Write down the questions you have to choose from when creating an account.
3. Insert into the “25 things ..” list.
4. PROFIT!!!

As I said at the outset, I hesitated to write this post, in part because of what may be perceived as the obviousness of the problem. But in the past couple months, I’ve had several conversations with developers to whom this is all completely new. A couple of those conversations happened just last week. So I decided to write it and wreak suffering upon the unsuspecting.

Solutions? Read those last two paragraphs again:

* choose good questions. Nope, no guidance on that right now.
* multiple questions, although that just adds a speed bump by making it a trifle harder to crack with brute force.
* Expect demonstrated control of a resource.
* closely related to that, multi-factor authentication, although man-in-the-middle attacks render it less than ideal.
* Lock accounts for failed password retrieval attempts, or at least treat them the same way as failed logins.

Silver bullet? No. Just small design considerations that make small improvements. I’m not trying to suggest a good password retrieval system in this post, although maybe I should another time.