(Untitled)

[shreena]

I was talking about this with quizcustodet today..  I think it's really odd that banks still ask you your mother's maiden name as a security question.  Surely, for a fair number of people, this is not an especially secure question?  If your parents weren't married and you have your mother's name..  If your parents were married and your mother didn't change her

Comments

[hatam_soferet]

Oh - totally agree. Very silly question, and not all that difficult to find out the answer even if she did change it at some point. I chose a random surname that actually isn't my mother's maiden name, which I give every time I'm asked for her maiden name. Same effect as choice of security question :)

[piqueen]

I remember being asked for a "memorable name" a few years ago when setting up a new account. I must have looked blank because the cashier said "most people pick their mother's maiden name". Does that count as a choice of question?

[shreena]

I think that makes more sense because, then, if your name is the same as your mother's maiden name, you can pick something more secure. I'd personally be inclined to pick my grandmother's maiden name as being more secure but still memorable to me.

[beckyc]

I think that you are right. I have wondered about this - most of my family knows my date of birth, my Mother's maiden name and where I live. Any of them that I've given a cheque to will have my account details.

Good job I trust them really :-)

[robert_jones]

I think it's an odd question anyway, since my mother's maiden name isn't a secret. You could find it out at the register of births, deaths and marriages, apart from anything else. But I suppose it puts off opportunistic identity thieves.

[cartesiandaemon]

Several other questions are rather badly designed too; I don't know the exact history, but it's clear to me this is a case of this is where the bureaucracy ended up, rather than something that was designed from scratch to fulfil all the necessary criteria.

As a default secret question goes, your mother's maiden name was fairly good: for most people it's something they easily know, but most of their friends don't know.

But as you point out, that and similar questions have lots of flaws:

* They're asked online as a single point of failure (or along with a birth date), so a determined attacker can find them out and use them (rather than having the additional hurdle of going to a bank and being calm while pretending to be you)
* Friends can find them out