When you register for an account on a particular website, 9 times out of 10 (in fact, more than that), you will be asked to enter a secret question or two, in case you ever forget your credentials. The purpose of these secret questions is to be able to verify that you are you, even if you are entering the incorrect username/password details.
Now, in most cases, if you have forgotten your password, most websites will ask you the secret question you set up, and then send you an e-mail with a unique website address that allows you to reset your password. The security feature here being that even if somebody did answer your secret questions, they wouldn’t be able to change your password because they would have to know the login details for your e-mail account.
However, some services (none come to mind immediately) continue the process on-screen. Once you have entered the answer to your secret question you can carry on and reset your password without having to validate that you are you by clicking a link in your inbox.
The issue here is that, a lot of the typical surveys you see on social networking websites (the ones that ask you if you have any pets, what their names are, and if you’ve ever eaten pizza whilst covering your left eyebrow with a pink thong) ask questions (such as what is the name of your pet fish) that people use as the answers to their secret questions. Imagine the amount of people who use the name of their cat as one of the secret questions, and the amount of people who answer the question “what is the name of your pet?” in a survey. That’s a gold mine of compromised account details, right there.
My online banking service allows me to have a password and a secret key. If someone had my account details and my password, and my secret key was something as stupid as the name of my pet, that would be my bank account compromised just by answering a silly survey on Facebook.
Think about it next time, if you care.
