Aaron Toponce

Some of you may remember the email hack of Sarah Palin's email by David Kernell in 2008. The Wikipedia article describes how this was done:

The hacker, David Kernell, had obtained access to Palin's account by looking up biographical details such as her high school and birthdate and using Yahoo!'s account recovery for forgotten passwords.

Ever since then, I decided to change how I answer these "security questions" on websites. Knowing what I know about security and cryptography, I applied what I knew to these security questions. Here's how I handle them now:

1. Generate a random string of characters, known as a "salt". Something like "Ga0Au1Ieshea".
2. Answer the question. If the question is "What is your mother's maiden name?", suppose the answer is "Smith".
3. Apply MD5(salt+answer). In this case, it would be MD5(Ga0Au1IesheaSmith) which results in "28e03f4c2d90b8c1120bf541927976f1".

So, when the site is asking you "What is your mother's maiden name?", the answer you would provide is "28e03f4c2d90b8c1120bf541927976f1".

Obviously, there are a couple concerns that you should be aware of. First, the form field might have a character limit. Adjust accordingly. You could provide the first x-characters, based on the restriction. Personally, I've never seen this restriction, but I certainly won't say that it hasn't been implemented. Second, it's critical that you generate a strong random salt, and that you keep the salt private. If the salt is known, or weak, then this whole thing falls apart, and you're no better off than just providing the answer to the question.

But, if you do everything correct, then you have tightened down these lame "security questions", and the attacker will not be any more successful than hacking your account password. And, by using a cryptographically secure hashing algorithm, the output will always be the same. Feel free to use SHA1 or some other hashing algorithm instead of MD5.