Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google
“Our analysis confirms that secret questions generally offer a security level that is far lower than user-chosen passwords. (…) Surprisingly, we found that a significant cause of this insecurity is that users often don't answer truthfully. (…) On the usability side, we show…
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
Clearing up some misconceptions about Passkeys stavros.io
Or why passkeys are not worse than passwords.
-
GCP improved account management policies to better support customers cloudplatform.googleblog.com
Or why relying too much on fraud automation might lead to disgruntled users.
-
-
How effective is basic account hygiene at preventing hijacking security.googleblog.com
Google security team's data shows 2FA blocks 100% of automated bot hacks.
-
Git Guardian gitguardian.com
State of Secrets Sprawl (2026) - Examines the state of secrets sprawl and security vulnerabilities, detailing the impact of rapid development cycles and AI adoption. Key findings reveal 28.65 million new hardcoded secrets in public GitHub commits during 2025, representing a 34…
-
Millions of Secrets Exposed via Web Application Frontends web.archive.org
Millions of secrets exposed in web app frontends via JavaScript and debug pages.
IAM › Multi-factor auth: ““Our analysis confirms that secret questions generally offer a security level that is far lower than user-chosen passwords. (…) Surprisingly, we found that a significant cause of this insecurity is that users often don't answer truthfully. (…) On the usability side, we show…”