Google Loopholes In Using Secret Question

Using only a secret question to reset a forgotten password is unsafe and should be avoided, as Google sets on the basis of own research ( pdf ). Many sites still use the secret question as a way for users to access their account if they have forgotten the login details. The problem of the secret question is that attackers can try to guess the answer and so to reset the password.

Thus, an attacker with the secret question of English users "what is your favorite meal" 19.7% chance to guess which one time. The answer is "pizza". With ten attempts an attacker 24% chance the question "what is the name of your first teacher" to answer in Arabic speaking users. With the same number of attempts an attacker 21% chance the question of Spanish speakers, "What is your father's middle name," to answer. In the case of Koreans make ten attempts a success rate of 39% on the question "what city were you born" and 43% with the question of what is the favorite food.

It also showed that many users had identical answers to secret questions which are believed to be correct very safe, such as "what is your phone number" and "what is your airmiles number". In this case it was found that 37% of people intentionally wrong information by filling out the idea that this makes the answer more difficult to guess. The research, which Google hundreds of millions of secret questions and answers analyzed, also shows that 40% of English speaking users the answer to the secret question no longer know if they have to fill.

Unfit

According to the researchers, the study shows that the secret question really is unfit to reset passwords and websites as well as users should think carefully whether they want to use secret questions. Google says that the secret question not be used as a standalone way to reset passwords. Furthermore, should website owners use other authentication methods, such as SMS codes or a second email address. "That is both safer and easier to use," concludes Elie Bursztein Google.

Google Reveals Password Alert Against Phishing Attacks

To prevent Internet users enter the password for their Google Account phishing sites, Google has released a new security measure unveiled . " Password Alert "is a Chrome extension that alerts users when they enter their Google password on a phishing site.

The extension, which is open source, should protect users from phishing attacks as well as encourage the use of different passwords for different websites. Once the Chrome extension is installed that will store an encrypted version of the password.Google describes this as a " salted reduced-bit thumbnail ". The extension only stores this information for security purposes and which will not share with others. Google notes that no Password Alert keylogger is no keystrokes and stores or transmits.

Chrome already offers "Safe Browsing" to warn users of phishing attacks, but it may be that phishing sites will be missed.Password will alert every time a user's Google password on a Web site that does not fill accounts.google.com is sound the alarm and tell the user to change his password. Something can be done directly through the warning. At this time, Password Alert only available for Chrome users.