[PLUG-TALK] Challenge Question Authentication Holy S***!

[Rich Shepard]

On Sun, 3 Apr 2016, Keith Lofstrom wrote:

> The problem is, most websites use the same short list of security
> questions, like "what was the name of your first pet?" and "what was the
> name of your elementary school?"

   Financial institutions in particular should all authenticate by sending a
one-time 6-digit number to the user's telephone. That number is then
provided in a text entry widget on the web page before access is allowed.
That makes more sense than questions, unless the user is allowed to make up
the question and provide the answer when opening the on-line account.

Rich