Credential Recovery Using Challenge Questions

1
Credential Recovery Using Challenge Questions

• COMP 9500W - 95.590W Winter 2003
• Mike Just
• February 6th, 2003

2
Outline

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

3
User Identification

• Categories
• What you know, have, are
• What you know is most common
• Have and Are
• Can be expensive or impractical
• Often in combination with what you know
• Problem What you know can be forgotten

4
User Identification

• Recall versus recognition
• Passwords are memorized and recalled
• Alphanumeric or graphical
• Pictures are viewed/remembered and later
  recognized
• Still, what if theyre forgotten?

5
Outline Update

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

6
User Recovery

• Primary credential is lostnow what?
• What credential is to be recovered?
• Password, private keys, account information and
  entitlements,
• Recovery method can depend on the relationship
  between the user and the system

7
User Recovery

• If the user identified themselves as part of
  registration,
• User can re-register. This is often done using
  so-called shared secrets.
• Digital shared secrets not always available,
  e.g. if user registered in person with drivers
  license
• Alternatively (e.g. user might not have
  identified as part of registration)
• Shared secrets or other repeatable information
  can be deposited as part of registration by the
  user with the system

8
Recovery versus Login

• Recovery process should not similarly rely on
  memorization as login does
• Since a memory loss at login prompts recovery
• A recovery process will be executed less
  frequently.so, a recovery process can be more
  time consuming than login
• This allows for a process that might not be
  otherwise be acceptable at login

9
User Recovery

• At registration, the user deposits information
  that they expect to be i. Secret to them,
  andii. Very memorable.
• Some familiar (not necessarily good!) examples
  includei. Mothers maiden name, users
  date-of-birth
• At recovery, the user is asked to provide the
  deposited information

10
User Recovery

• Often uses challenge questions or password
  recovery hints
• When recovery is automated, it can be very
  cost-effective
• Avoids help-desk calls (which typically involve
  human interaction)
• In a way, it requires the user to recover based
  on
• Something they know, and
• Something they are (in case the answer refers
  to something inherent to them as a person)

11
Outline Update

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

12
Challenge Questions

• At registration (e.g. when a username and
  password are typically chosen), one or more
  challenge questions and answers are deposited
• At recovery, the user is challenged with one or
  more questions, and required to present the
  answers
• If successful, the users account is recovered
• Question might be fixed by system or selected by
  user

13
Examples

• Yahoo!
• http//edit.yahoo.com/config/eval_register?.intlu
  snew1.done.src.v0.u7rgjeb4v43cbipartner
  .ppromo.last

14
(No Transcript)
15
Challenge Question Security

• A few ways to measure security
• E.g. based upon answer quality
• For example, are the following good answers?
• Your mothers maiden name
• Your date of birth
• Your Grade 8 locker combination
• Why or why not?

16
Answer Criteria

• To consider some desirable properties for
  answers, we should consider the types of answers
  that could be provided
• Physical user characteristics, e.g. eye colour,
• Names (family, friends, movie stars, )
• Places (Honeymoon, vacation, birth,)
• Things (Car, account numbers,)
• Though not exhaustive, these types help us
  identify some general guidelines

17
Answer Criteria

• Some security criteria
• The answer should be difficult to exhaustively
  guess
• Answer should have high entropy
• The answer should be difficult to observe
• E.g. What type of car do I own?
• The answer should be difficult to find
• The Internet is often claimed to be a source of
  personal user information
• Can be hard to satisfy all simultaneously

18
Outline Update

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

19
Challenge Question Model

• Lets examine more closely the model in which
  questions and answers are registered and
  presented
• In particular, well determine
• Security, and
• We looked at the answer quality previously. Now
  well look at the quality of the model. Later,
  question quantity.
• Usability issues

20
Challenge Question Model

• Usability is important since
• A useable scheme is typically more secure
• A useable scheme will typically be used more
  cost-effectively
• Memorize-ability
• Ability for users to recall or remember answers
• Repeatability
• Ability for users to consistently enter their
  answer

21
Outline Update

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

22
Questions

• Fixed
• User is provided a fixed list of questions
• Open
• User is able to select (and enter, free-form)
  their own question

23
Fixed Questions

• Security
• Users not allowed to choose bad questions, e.g.
  What is my name?
• Usability
• Users are not required to produce a question
  (depends on user)
• Question choices must be robust enough to satisfy
  all users

24
Open Questions

• Security
• Users may choose bad questions
• Users are able to choose creative questions
• What was my Grade 8 locker combination?
• Word association
• Usability
• Users are required to produce a question (depends
  on user)

25
Controlled Questions

• More rigid than open but less than fixed
• User can customize a fixed question
• Allows a smaller set of more general questions to
  be asked
• Fill in the blanks
• What is _____s favourite food?
• Hint based
• What is a memorable date for you?
• Hint ________________________
• Response ___________________

26
Controlled Questions

• Security
• Balance between fixed and controlled
• Might still choose a bad hint (e.g. by putting
  answer in hint!)
• Though the set of hints could be fixed
• Allows for some creativity as do open questions
• Usability
• Hint can be optional -gt becomes fixed
• Improves memorize-ability
• Permits question personalization
• Might be hard to think of a good hint

27
Outline Update

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

28
Answers

• Fixed
• User is provided a fixed list of answers
• Open
• User is able to select (and enter, free-form)
  their own answer

29
Fixed Answers

• Security
• Users prevented from selecting bad answers
• Highly probable, e.g. What is your favourite
  sport? -- Hockey
• Usability
• Preferred answer might not be available (affects
  memorize-ability)
• More than one answer might be suitable (affects
  repeatability)

30
Open Answers

• Security
• User can select bad answer
• Arguably high answer entropy
• Usability
• Allows for a more personal response
• Repeatability may be a problem
• St. versus Street
• Mike versus Michael

31
Controlled Answers

• A slight restriction of open answers
• Input is controlled upon registration
• Drop-down menus, e.g. date
• Allow only a numeric answer
• Not allowing short-forms or contractions

32
Controlled Answers

• Security
• Dont seem to differ much from open
• Usability
• Improved repeatability

33
Outline Update

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

34
Combinations

• Fixed question
• Fixed answer, controlled or open answer
• Controlled question
• Fixed answer, controlled or open answer
• Open Answer
• Controlled or open answer

35
Number of Questions

• Security
• The sufficient number depends on the security
  estimate for the answers
• Usability
• Register n questions Ask n questions
• Is there much advantage to
• Registering n, asking t, or
• Registering n, asking t, requiring s correct?

36
Outline Update

• User Identification
• User Recovery
• Challenge Questions
• Model
• Questions
• Answers
• Other
• Conclusion

37
Conclusion

• Alternatives to challenge questions
• Biometrics
• Voice can be done over the phone
• Re-registration
• Include an email or (hard) mail to
  address-of-record as part of recovery