Agent Wranglers

Second factors and recovery Avoid

Never use security questions

Never use security questions, or facts such as a birth date or the last digits of a card, to sign in or recover an account.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Answers are guessable or easy to find online, and NIST SP 800-63B-4 forbids knowledge-based authentication. Use recovery codes, a second factor or the process in plan for losing every factor instead. Remove existing questions and delete the stored answers.

How to check

Search the schema and the code for names such as security_question, secret_answer or maiden. Nothing matches.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/no-security-questions.