Choosing and Using Security Questions Cheat Sheet / 选择和使用安全问题的备忘单

Introduction / 介绍

WARNING: Security questions are no longer recognized as an acceptable authentication factor per NIST SP 800-63. Account recovery is just an alternate way to authenticate so it should be no weaker than regular authentication. See SP 800-63B sec 5.1.1.2 paragraph 4: Verifiers SHALL NOT prompt subscribers to use specific types of information (e.g., “What was the name of your first pet?”) when choosing memorized secrets.

警告：根据NIST SP 800-63，安全问题不再被视为可接受的身份验证因素。账户恢复只是另一种身份验证方式，因此它不应比常规身份验证更弱。参见SP 800-63B第5.1.1.2段第4点：验证者不得提示订阅者使用特定类型的信息（例如，“你第一只宠物的名字是什么？”）来选择记忆中的秘密。

If you are curious, please have a look at this study by Microsoft Research in 2009 and this study performed at Google in 2015. The accompanying Security blog update includes an infographic on the issues identified with security questions.

如果您对此感兴趣，请查看微软研究在2009年进行的这项研究和谷歌在2015年进行的这项研究。相关的安全博客更新包括了一个关于安全问题识别问题的信息图。

Please Note: While there are no acceptable uses of security questions in secure software, this cheat sheet provides guidance on how to choose strong security questions for legacy purposes.

请注意：虽然在安全软件中没有可接受的安全问题使用，但此备忘单提供了关于如何为旧版目的选择强大安全问题的指导。

Choosing Security Questions / 选择安全问题

Desired Characteristics / 期望特征

Any security questions presented to users to reset forgotten passwords must meet the following characteristics:

向用户展示以重置忘记密码的安全问题必须满足以下特征：

Characteristic / 特性	Explanation / 说明
Memorable 易于记忆	The user must be able to recall the answer to the question, potentially years after creating their account. 用户必须能够在创建账户多年后回忆起问题的答案。
Consistent 一致	The answer to the question must not change over time. 问题的答案必须随时间不变。
Applicable 适用	The user must be able to answer the question. 用户必须能够回答该问题。
Confidential 机密	The answer to the question must be hard for an attacker to obtain. 问题的答案必须难以被攻击者获取。
Specific 具体	The answer should be clear to the user. 用户应该能够清楚地理解答案。

Types of Security Questions / 安全问题的类型

Security questions fall into two main types. With user defined security questions, the user must choose a question from a list, and provide an answer to the question. Common examples are "What is your favourite colour?" or "What was your first car?"

These are easy for applications to implement, as the additional information required is provided by the user when they first create their account. However, users will often choose weak or easily discovered answers to these questions.

这些问题对应用程序来说很容易实现，因为用户在首次创建账户时就已经提供了所需的信息。然而，用户通常会选择弱或容易被发现的答案来回答这些问题。

System defined security questions are based on information that is already known about the user. This approach avoids having to ask the user to provide specific security questions and answers, and also prevents them from being able to choose weak details. However it relies on sufficient information already being stored about the user, and on this information being hard for an attacker to obtain.

系统定义的安全问题基于用户已知的信息。这种方法避免了要求用户提供特定的安全问题及其答案，同时也防止了他们选择弱信息。然而，它依赖于已经存储了足够关于用户的信息，并且这些信息对攻击者来说很难获取。

User Defined Security Questions / 用户定义的安全问题

Bad Questions / 不良问题

Any questions that do not have all of the characteristics discussed above should be avoided. The table below gives some examples of bad security questions:

任何不具备上述所有特征的问题都应该避免。下表给出了一些不良安全问题的示例：

Question / 问题	Problem / 问题
When is your date of birth? 您的出生日期是什么时候？	Easy for an attacker to discover. 攻击者很容易发现。
What is your memorable date? 您记得的日期是什么？	Most users will just enter their birthday. 大多数用户会直接输入他们的生日。
What is your favourite movie? 您最喜欢的电影是什么？	Likely to change over time. 这可能会随着时间的推移而改变。
What is your favourite cricket team? 你最喜欢的板球队伍是哪支？	Not applicable to most users. 大多数用户不适用。
What is the make and model of your first car? 你第一辆车的品牌和型号是什么？	Fairly small range of likely answers. 可能的答案范围相当有限。
What is your nickname? 你的昵称是什么？	This could be guessed by glancing through social media posts. 这可以通过浏览社交媒体帖子来猜测。

Additionally, the context of the application must be considered when deciding whether questions are good or bad. For example, a question such as "What was your maths teacher's surname in your 8th year of school?" would be very easy to guess if it was used in a virtual learning environment for your school (as other students probably know this information), but would be much stronger for an online gaming website.

此外，在决定问题是否良好或不良时，必须考虑应用程序的上下文。例如，如果在一个为你的学校提供的虚拟学习环境中使用“你在8年级时的数学老师姓什么？”这样的问题，那么这个问题很容易被猜测（因为其他学生可能知道这个信息），但对于一个在线游戏网站来说，这个问题会更强。

Good Questions / 良好问题

Many good security questions are not applicable to all users, so the best approach is to give the user a list of security questions that they can choose from. This allows you to have more specific questions (with more secure answers), while still providing every user with questions that they can answer.

许多良好的安全问题并不适用于所有用户，因此最佳方法是提供一个用户可以选择的问题列表。这允许您拥有更具体的问题（以及更安全的答案），同时仍然为每个用户提供他们能够回答的问题。

The following list provides some examples of good questions:

以下列表提供了一些良好问题的示例：

• What is the name of a college you applied to but didn’t attend?
  中文：你申请过但没有就读的大学的名字是什么？
• What was the name of the first school you remember attending?
  中文：你记得的第一所学校叫什么名字？
• Where was the destination of your most memorable school field trip?
  中文：你记忆最深刻的学校郊游的目的地是哪里？
• What was your maths teacher's surname in your 8th year of school?
  中文：你在学校八年级时的数学老师的姓是什么？
• What was the name of your first stuffed toy?
  中文：你第一个毛绒玩具的名字是什么？
• What was your driving instructor's first name?
  中文：您的驾驶教练的名字是什么？

Much like passwords, there is a risk that users will re-use recovery questions between different sites, which could expose the users if the other site is compromised. As such, there are benefits to having unique security questions that are unlikely to be shared between sites. An easy way to achieve this is to create more targeted questions based on the type of application. For example, on a share dealing platform, finance-related questions such as "What is the first company you owned shares in?" could be used.

与密码类似，用户可能会在不同网站之间重复使用恢复问题，如果其他网站被入侵，这可能会暴露用户。因此，拥有独特且不太可能在网站之间共享的安全问题是有所裨益的。实现这一点的一个简单方法是根据应用程序的类型创建更具体的问题。例如，在股票交易平台上，可以使用与财务相关的问题，如“您第一家公司持有股份的是什么？”

Allowing Users to Write Their Own Questions / 允许用户自行提问

Allowing users to write their own security questions can result in them choosing very strong and unique questions that would be very hard for an attacker to guess. However, there is also a significant risk that users will choose weak questions. In some cases, users might even set a recovery question to a reminder of what their password is - allowing anyone guessing their email address to compromise their account.

允许用户自行设置安全问题是他们选择非常强大且独特的提问，这对攻击者来说非常难以猜测。然而，也存在用户选择弱问题的重大风险。在某些情况下，用户甚至可能将恢复问题设置为密码的提示——允许任何人猜测他们的电子邮件地址来破坏他们的账户。

As such, it is generally best not to allow users to write their own questions.

因此，通常最好不允许用户自行提问。

Restricting Answers / 限制答案

Enforcing a minimum length for answers can prevent users from entering strings such as "a" or "123" for their answers. However, depending on the questions asked, it could also prevent users from being able to correctly answer the question. For example, asking for a first name or surname could result in a two letter answer such as "Li", and a color-based question could be four letters such as "blue".

强制答案的最小长度可以防止用户输入如“a”或“123”这样的字符串作为答案。然而，根据提出的问题，这也可能阻止用户正确回答问题。例如，要求提供名字或姓氏可能导致两个字母的答案，如“李”，而基于颜色的提问可能是四个字母，如“blue”。

Answers should also be checked against a denylist, including:

答案还应与拒绝列表进行核对，包括：

• The username or email address.
  中文：用户名或电子邮件地址。
• The user's current password.
  中文：用户的当前密码。
• Common strings such as "123" or "password".
  中文：常见的字符串，如“123”或“password”。

Renewing Security Questions / 更新安全问题

If the security questions are not used as part of the main authentication process, then consider periodically (such as when they are changing their passwords after expiration) prompting the user to review their security questions and verify that they still know the answers. This should give them a chance to update any answers that may have changed (although ideally this shouldn't happen with good questions), and increases the likelihood that they will remember them if they ever need to recover their account.

如果安全问题不是作为主要认证过程的一部分，那么可以考虑定期（例如，在他们密码过期后更改密码时）提示用户回顾他们的安全问题，并验证他们是否仍然知道答案。这应该给他们一个机会更新可能已更改的任何答案（尽管理想情况下这不应该发生），并增加他们在需要恢复账户时记住它们的可能性。

System Defined Security Questions / 系统定义的安全问题

System defined security questions are based on information that is already known about the user. The users' personal details are often used, including the full name, address and date of birth. However these can easily be obtained by an attacker from social media, and as such provide a very weak form of authentication.

系统定义的安全问题是基于用户已知的信息。用户的个人详细信息通常被使用，包括全名、地址和出生日期。然而，这些信息很容易被攻击者从社交媒体上获取，因此提供了一种非常薄弱的认证形式。

The questions that can be used will vary hugely depending on the application, and how much information is already held about the user. When deciding which bits of information may be usable for security questions, the following areas should be considered:

可以使用的问题将根据应用程序以及已经掌握的用户信息量而有很大差异。在决定哪些信息可能用于安全问题，应考虑以下领域：

• Will the user be able to remember the answer to the question?
  中文：用户能否记住问题的答案？
• Could an attacker easily obtain this information from social media or other sources?
  中文：攻击者能否轻易地从社交媒体或其他来源获取这些信息？
• Is the answer likely to be the same for a large number of users, or easily guessable?
  中文：答案对于大量用户来说是否可能相同，或者容易被猜到？

Using Security Questions / 使用安全问题

When to Use Security Questions / 何时使用安全问题

Applications should generally use a password along with a second authentication factor (such as an OTP code) to authenticate users. The combination of a password and security questions does not constitute MFA, as both factors are the same (i.e. something you know)..

应用程序通常应使用密码以及第二个认证因素（如一次性密码）来验证用户。密码和安全问题的组合不构成多因素认证，因为这两个因素是相同的（即你知道的某物）..

Security questions should never be relied upon as the sole mechanism to authenticate a user. However, they can provide a useful additional layer of security when other stronger factors are not available. Common cases where they would be used include:

安全问题绝不应作为验证用户的唯一机制。然而，当没有其他更强的因素时，它们可以提供有用的额外安全层。它们会被使用的常见情况包括：

• Logging in.
  中文：登录
• Resetting a forgotten password.
  中文：重置忘记的密码。
• Resetting a lost MFA token.
  中文：重置丢失的多因素认证令牌。

Authentication Flow / 身份验证流程

Security questions may be used as part of the main authentication flow to supplement passwords where MFA is not available. A typical authentication flow would be:

安全问题可以作为主要身份验证流程的一部分，在无法使用多因素认证时补充密码。典型的身份验证流程如下：

• The user enters their username and password.
  中文：用户输入他们的用户名和密码。
• If the username and password are correct, the user is presented with the security question(s).
  中文：如果用户名和密码正确，用户将看到安全问题。
• If the answers are correct, the user is logged in.
  中文：如果答案正确，用户将被登录。

If the answers to the security questions are incorrect, then this should be counted as a failed login attempt, and the account lockout counter should be incremented for the user.

如果安全问题的答案不正确，则应将其视为失败的登录尝试，并增加用户的账户锁定计数器。

Forgotten Password or Lost MFA Token Flow / 忘记密码或丢失MFA令牌流程

Forgotten password functionality often provides a mechanism for attackers to enumerate user accounts if it is not correctly implemented. The following flow avoids this issue by only displaying the security questions once the user has proved ownership of the email address:

忘记密码功能如果实现不当，常常为攻击者提供了枚举用户账户的机制。以下流程通过仅在用户证明对电子邮件地址的所有权后显示安全问题来避免此问题：

• The user enters email address (and solves a CAPTCHA).
  中文：用户输入电子邮件地址（并解决CAPTCHA）。
• The application displays a generic message such as "If the email address was correct, an email will be sent to it".
  中文：应用程序显示一条通用消息，例如“如果电子邮件地址正确，将向其发送电子邮件”
• An email with a randomly generated, single-use link is sent to the user.
  中文：发送给用户一封包含随机生成、单次使用的链接的电子邮件。
• The user clicks the link.
  中文：用户点击链接。
• The user is presented with the security question(s).
  中文：用户将看到安全问题。
• If the answer is correct, the user can enter a new password.
  中文：如果答案正确，用户可以输入新密码。

How to Use Security Questions / 如何使用安全问题

Storing Answers / 存储答案

The answers to security questions may contain personal information about the user, and may also be re-used by the user between different applications. As such, they should be treated in the same way as passwords, and stored using a secure hashing algorithm such as Bcrypt. The password storage cheat sheet contains further guidance on this.

安全问题的答案可能包含关于用户个人的信息，并且用户可能在不同的应用程序之间重复使用这些答案。因此，它们应该像密码一样被对待，并使用如Bcrypt之类的安全哈希算法进行存储。密码存储速查表包含了更多关于这一点的指导。

Comparing Answers / 比较答案

Comparing the answers provided by the user with the stored answer in a case-insensitive manner makes it much easier for the user. The simplest way to do this is to convert the answer to lowercase before hashing the answer to store it, and then lowercase the user-provided answer before comparing them.

以不区分大小写的方式比较用户提供的答案与存储的答案，这会大大简化用户的使用。最简单的方法是在对答案进行哈希存储之前将其转换为小写，然后在比较之前将用户提供的答案也转换为小写。

It is also beneficial to give the user some indication of the format that they should use to enter answers. This could be done through input validation, or simply by recommending that the user enters their details in a specific format. For example, when asking for a date, indicating that the format should be "DD/MM/YYYY" will mean that the user doesn't have to try and guess what format they entered when registering.

给用户一些关于他们应该使用的答案格式的指示也是有利的。这可以通过输入验证来完成，或者简单地建议用户以特定的格式输入他们的详细信息。例如，当询问日期时，指出格式应该是"DD/MM/YYYY"，这意味着用户不必尝试猜测他们在注册时输入的格式。

Updating Answers / 更新答案

When the user updates the answers to their security questions, this should be treated as a sensitive operation within the application. As such, the user should be required to re-authenticate themselves by entering their password (or ideally using MFA), in order to prevent an attacker updating the questions if they gain temporary access to the user's account.

当用户更新他们的安全问题答案时，这应该在应用程序中被视为一个敏感操作。因此，用户应该被要求通过输入密码（或者理想情况下使用多因素认证）重新验证自己的身份，以防止攻击者在获得用户账户的临时访问权限时更新这些问题。

Multiple Security Questions / 多重安全问题

When security questions are used, the user can either be asked a single question, or can be asked multiple questions at the same time. This provides a greater level of assurance, especially if the questions are diverse, as an attacker would need to obtain more information about the target user. A mixture of user-defined and system-defined questions can be very effective for this.

当使用安全问题时，用户可能被问及单个问题，或者同时被问及多个问题。这提供了一种更高的保证级别，尤其是如果问题多样化，因为攻击者需要获取更多关于目标用户的信息。用户自定义和系统定义问题的混合使用可以非常有效。

If the user is asked a single question out of a bank of possible questions, then this question should not be changed until the user has answered it correctly. If the attacker is allowed to try answering all of the different security questions, this greatly increases the chance that they will be able to guess or obtain the answer to one of them.

如果用户从可能的问题库中选择了单个问题，那么在用户正确回答之前，这个问题不应被更改。如果允许攻击者尝试回答所有不同的安全问题，这将大大增加他们猜测或获取其中一个答案的机会。

References / 参考

• Google Research: Secrets, Lies, and Account Recovery) （谷歌研究：秘密、谎言和账户恢复）
• NIST SP 800-63B-4: Authentication and Authenticator Management) （NIST SP 800-63B-4：身份验证和身份验证器管理）