Everyone, by now, has run into those “security questions” – sets of questions you need to answer to set up an online account (or sometimes to continue using an existing one). They ask a number of questions that are supposed to identify you in the event that you forget your password or (less frequently) need to be contacted to confirm that some online activity isn’t fraudulent. The name “security questions” tends to imply that they improve the security of your account, but much of the time the opposite is true. It also points to another problem with the username/password infrastructure we have, and more generally with the use of shared secrets for authentication.

Short answer: No.

Passwords, passphrases, codes, PINs: They’re everywhere. And in many cases they are good enough. Will we have biometric readers at ATMs? Someday, maybe. But for now a four-digit PIN provides sufficient security while maintaining usability.

I recently moved my IP phone into a shared phone room/recording studio at my coworking space. I didn’t want just anyone to pick up the phone and make free calls on OneID’s dime. While I trust the small community that shares the office space with me, I didn’t want just anyone to be able to answer my calls. They might not even know this is a private phone. So I configured the phone to require a password after it’s idle for a few minutes.