text: (self.webpackChunkdocusaurus_template=self.webpackChunkdocusaurus_template||[]).push([[57231],{3905:function(e,t,n){"use strict";n.d(t,{Zo:function(){return l},kt:function(){return h}});var o=n(67294);function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function s(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,o)}return n}function i(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?s(Object(n),!0).forEach((function(t){r(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):s(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function a(e,t){if(null==e)return{};var n,o,r=function(e,t){if(null==e)return{};var n,o,r={},s=Object.keys(e);for(o=0;o<s.length;o++)n=s[o],t.indexOf(n)>=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var s=Object.getOwnPropertySymbols(e);for(o=0;o<s.length;o++)n=s[o],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var u=o.createContext({}),c=function(e){var t=o.useContext(u),n=t;return e&&(n="function"==typeof e?e(t):i(i({},t),e)),n},l=function(e){var t=c(e.components);return o.createElement(u.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return o.createElement(o.Fragment,{},t)}},d=o.forwardRef((function(e,t){var n=e.components,r=e.mdxType,s=e.originalType,u=e.parentName,l=a(e,["components","mdxType","originalType","parentName"]),d=c(n),h=r,f=d["".concat(u,".").concat(h)]||d[h]||p[h]||s;return n?o.createElement(f,i(i({ref:t},l),{},{components:n})):o.createElement(f,i({ref:t},l))}));function h(e,t){var n=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var s=n.length,i=new Array(s);i[0]=d;var a={};for(var u in t)hasOwnProperty.call(t,u)&&(a[u]=t[u]);a.originalType=e,a.mdxType="string"==typeof e?e:r,i[1]=a;for(var c=2;c<s;c++)i[c]=n[c];return o.createElement.apply(null,i)}return o.createElement.apply(null,n)}d.displayName="MDXCreateElement"},20971:function(e,t,n){"use strict";n.r(t),n.d(t,{frontMatter:function(){return a},contentTitle:function(){return u},metadata:function(){return c},toc:function(){return l},default:function(){return d}});var o=n(22122),r=n(19756),s=(n(67294),n(3905)),i=["components"],a={id:"security-questions-best-practice",title:"Choosing Security Questions"},u=void 0,c={unversionedId:"guides/security-questions-best-practice",id:"version-v0.7/guides/security-questions-best-practice",isDocsHomePage:!1,title:"Choosing Security Questions",description:"Security questions are currently not supported for this flow, but might be added",source:"@site/versioned_docs/version-v0.7/guides/security-questions.mdx",sourceDirName:"guides",slug:"/guides/security-questions-best-practice",permalink:"/kratos/docs/guides/security-questions-best-practice",editUrl:"https://github.com/ory/kratos/edit/master/docs/versioned_docs/version-v0.7/guides/security-questions.mdx",version:"v0.7",lastUpdatedBy:"aeneasr",lastUpdatedAt:1626195872,formattedLastUpdatedAt:"7/13/2021",frontMatter:{id:"security-questions-best-practice",title:"Choosing Security Questions"}},l=[],p={toc:l};function d(e){var t=e.components,n=(0,r.Z)(e,i);return(0,s.kt)("wrapper",(0,o.Z)({},p,n,{components:t,mdxType:"MDXLayout"}),(0,s.kt)("p",null,"Security questions are currently not supported for this flow, but might be added\nin a future version of Ory Kratos."),(0,s.kt)("p",null,"This section contains an overview of picking the right security questions.\nAnother good resource is\n",(0,s.kt)("a",{parentName:"p",href:"https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html"},"Choosing and Using Security Questions Cheat Sheet"),"."),(0,s.kt)("blockquote",null,(0,s.kt)("p",{parentName:"blockquote"},"One option is to allow the user to self-construct their own questions. The\nproblem with this though is that you end up with either painfully obvious\nquestions:"),(0,s.kt)("ul",{parentName:"blockquote"},(0,s.kt)("li",{parentName:"ul"},(0,s.kt)("strong",{parentName:"li"},"What colour is the sky?")),(0,s.kt)("li",{parentName:"ul"},(0,s.kt)("strong",{parentName:"li"},"How do you spell \u201cpassword\u201d?"))),(0,s.kt)("p",{parentName:"blockquote"},"Questions which can put people in an uncomfortable position when a human uses\nthe secret question for verification (such as in a call centre):"),(0,s.kt)("p",{parentName:"blockquote"},(0,s.kt)("strong",{parentName:"p"},"Who did I sleep with at the Christmas party?")),(0,s.kt)("p",{parentName:"blockquote"},"When it comes to secret questions, people need to be saved from themselves! In\nother words, the site itself should define the secret question, or rather\ndefine a series of secret questions from which the user can choose. And not\njust choose one either; ideally, the user should define two or more secret\nquestions at the time of account registration which can then be used as a\nsecond channel of identity verification. Having multiple questions adds a\nhigher degree of confidence to the verification process plus gives you\nopportunity to add randomness (not always show the same question) plus\nprovides a bit of redundancy should someone legitimate forget an answer."),(0,s.kt)("p",{parentName:"blockquote"},"So what makes a good secret question? There are a few different factors:"),(0,s.kt)("ul",{parentName:"blockquote"},(0,s.kt)("li",{parentName:"ul"},"It should be concise \u2013 the question is to the point and unambiguous"),(0,s.kt)("li",{parentName:"ul"},"The answer is specific \u2013 you don\u2019t want a question which could be answered\nin different ways by the same person"),(0,s.kt)("li",{parentName:"ul"},"The possible answers must be diverse \u2013 a question about someone\u2019s favourite\ncolour would result in a small subset of possible answers"),(0,s.kt)("li",{parentName:"ul"},"Answer discovery should be hard \u2013 if you can readily find the answer for\nanyone (think high-profile people) then it\u2019s no good"),(0,s.kt)("li",{parentName:"ul"},"The answer must be constant over time \u2013 asking for someone\u2019s favourite movie\nmay result in a different answer a year from now")),(0,s.kt)("p",{parentName:"blockquote"},(0,s.kt)("a",{parentName:"p",href:"https://www.troyhunt.com/everything-you-ever-wanted-to-know/"},"Source"))),(0,s.kt)("p",null,"Here are some good examples:"),(0,s.kt)("ul",null,(0,s.kt)("li",{parentName:"ul"},'What was the first concert you ever went to and where? (e.g. "Pink Floyd at\nGotham City Stadium")'),(0,s.kt)("li",{parentName:"ul"},"...")))}d.isMDXComponent=!0}}]);