Part 3 of 4
Why can a security question be weaker than a password?
Because the answer is often one search away.
In September 2008, during the US presidential campaign, a student got into Sarah Palin’s personal Yahoo email by resetting her password. The password recovery process asked common personal questions: date of birth (which the perpetrator said he found on Wikipedia in fifteen seconds) and her high school. He posted the new password publicly and was later convicted and sentenced to a year and a day.
A security question is a second password that you can’t change and anyone can research: your mother’s maiden name, your first pet, the street you grew up on. What makes a password personal is exactly what makes these answers public. The 2025 guidance leaves them off its list of safe ways to recover an account.