Security questions for kids?

April 22, 2008 9:22 AM

What are some decent password reset security questions for school aged kids?

We're building a site that we expect to get a lot of use in the schools here in the U.S. As such, we need some way to reset passwords that does not require an e-mail address since we are not allowed to require them. We're looking at using security questions along with a decent captcha, but the real question is, what are some good security questions a fifth grader might answer reliably?

posted by advicepig to computers & internet (24 comments total)

Favourites are good (pet, film, food, teacher etc.)
posted by le morte de bea arthur at 9:25 AM on April 22, 2008

Middle name, Pet's name, Street you grew up on,... oh wait, that's your porn star name!
posted by jozxyqk at 9:26 AM on April 22, 2008

What was the name of your Kindergarten (or 1st, 2nd, 3rd, 4th grade teacher) teacher?
What is the name of your first pet?
What color is your bedroom? (hm, maybe edging to a little creepy on that one)
What color is your backpack?
posted by jamaro at 9:30 AM on April 22, 2008

I would aim for mostly concrete things... middle name, first pet's name, first grade teacher, parent's first name, how many brothers do you have, what color is your hair, maybe?

As far as favorites go, don't those pretty much change every week for kids?
posted by redsparkler at 9:40 AM on April 22, 2008

Yeah, I'd stay away from favorites, but number/kind of siblings, pets and their names, hometown, etc are good. Things that they encounter daily, but are unlikely to change. I'd also avoid personal nicknames, many kids have a private nickname only family uses and I would be disturbed to find a website had encouraged them to use that.
posted by Science! at 9:59 AM on April 22, 2008

I think the main problem with most of those questions is that they're semi-common knowledge for anyone who knows the kids. My boss' daughter had her hotmail account password changed, so he had me reset it for her - her password reset question was 'favorite book character' (or something like that). I don't even know her and I got it right first time (Harry Potter)
Middle name would be good if everyone had a middle name (lots of people don't)
posted by missmagenta at 10:15 AM on April 22, 2008

If it's for security, then people who are going to want to get into their accounts are most likely people who know them, probably classmates. They will be well aware of stuff like backpack colours etc. Also favourites can change in a very short period of time at that age, so what they entered at account creation may not be at all of interest by the time they need to retrieve the password. Ask for something their parent/guardian can tell them when they create the account, and can tell them again when they forget, such as moms maiden name or so on.
posted by Iteki at 10:17 AM on April 22, 2008

Mum's maiden name is only secure as long as the mum is now married ;) But it is the 'standard' security question and is considered to be fairly secure (its certainly not something just anyone who went to school with them would know)
What about Zip Code? Everyone has one and by that age I would expect most kids to know theirs. Its something that most kids wouldn't know about other kids (I think)
posted by missmagenta at 10:27 AM on April 22, 2008

Mum's maiden name is only secure as long as the mum is now married

Well, no. Some women keep their married name after they get divorced. OTOH, some women don't change their name when they get married. Some kids don't have a mom -- how do you think those kids would feel about being asked their "mother's maiden name"? "Mother's maiden name" is too unreliable/sexist/heterosexist to be a good security question.

You shouldn't use anything visible like "backpack" or "address." That includes anything visible to anyone who's been inside their homes. Remember, kids go to each others' homes to hang out! So "the color of your bedroom" doesn't work.

Using things like "your address in first grade" doesn't work -- they might have had the same address in first grade as they do now, and other people might know that. Something like "your first-grade teacher" is not exactly private information. I remember students who were in my 1st or 2nd grade class who were also in my class in later grades, and they would be aware of this.

I have no suggestions for what will work -- just wanted to say that none of the above suggestions seems to work. Is there any personal information that every 5th grader knows about him/herself but that their friends are unlikely to know? I'm hard-pressed to think of any. Kids don't have a lot of private information. If it's something they know about, it's something they might talk about with friends. The one exception might be really serious stuff like medical/psychiatric disorders or family issues, but that wouldn't apply to all kids.
posted by jejune at 10:43 AM on April 22, 2008

What about Zip Code? Everyone has one and by that age I would expect most kids to know theirs. Its something that most kids wouldn't know about other kids

Considering how school districts work, it's common to have classmates who live right by you -- like, on the same block. So you could guess that they have the same zip code.
posted by jejune at 10:44 AM on April 22, 2008

What's your mother's (or father's) middle name?
What are the first three (four?) digits of your locker combination?

Colors aren't a fantastic idea because there aren't that many possibilities for someone trying to guess.
posted by phoenixy at 10:45 AM on April 22, 2008

What are the first three (four?) digits of your locker combination?

We certainly weren't allowed to put locks on our lockers in elementary school.
posted by jejune at 10:50 AM on April 22, 2008

Parent's middle name?
posted by LobsterMitten at 10:52 AM on April 22, 2008

Parent's birthday and year. Hi mom!
posted by sdrawkcab at 10:52 AM on April 22, 2008

parent's birthday sounds like the best suggestion so far ;)
posted by Xianny at 10:56 AM on April 22, 2008

I'll keep checking back, so don't let the best answers stop you.

I'd agree with most of the issues raised here. I suppose that's why I bothered to ask, once you dig in, you realize that there's not that much kids don't know about each other. I have yet to come up with one that my brother can't get, and well, when we were kids this could have spelled trouble.

From my initial list:

What color was your first bike?
What's your oldest brother's middle name?
What's your oldest sister's middle name?
posted by advicepig at 11:14 AM on April 22, 2008

As long as kids have several good choices, limitations like not having a middle name (or having two or three of them!) shouldn't stop them. The problem is when you only give a couple of security questions to choose from.

And true, some favorites change frequently for kids, but others don't. How many times did the average kid you know change his/her favorite pro/college football team? Chances are they have one or they don't, and it doesn't change much. Likewise, number or names of siblings is a lot more likely to change for kids at that age than if you wait a decade to ask. As for naming a first grade/kindergarten teacher, etc., you run up against kids who skipped a grade, got held back, moved mid-year, etc. Every question is going to leave some kids out.

Question ideas:
Who's the toughest superhero?
What's your favorite ice cream flavor?
Who is your favorite teacher?
What color is your kitchen?
Who is the best singer in your family?

Best of all: Give the kids an option to fill in their own security question.
posted by notashroom at 11:33 AM on April 22, 2008

I think the main problem with most of those questions is that they're semi-common knowledge for anyone who knows the kids.

Yep, I agree. Things that work for my elementary-age kids on our home computers:

~ What color is your toothbrush?
~ What color is mom's purse?
~ What was on your last birthday cake?
~ What color are your pajamas?
posted by _Mona_ at 11:45 AM on April 22, 2008

What's your oldest brother's middle name?

My brother has the same middle name as me. When I was a kid, other kids might very well have guessed that we had the same middle name, and they would have been right.

~ What color is your toothbrush?
~ What color are your pajamas?

5th graders have slumber parties. And how many different toothbrush colors are there ... 5?

~ What color is mom's purse?

Assumes that the mom has exactly one purse that the kid remembers. And again, colors don't really work.

And true, some favorites change frequently for kids, but others don't. How many times did the average kid you know change his/her favorite pro/college football team? Chances are they have one or they don't, and it doesn't change much.

If it's that unwavering, then their friends probably know about it. Also, you can't expect the kids to anticipate the problem with choosing a "favorite" that might change later on. "Well gee, I shouldn't use my favorite movie, as my current favorite movie is likely to be just a phase!" Kids don't think like that.

What color was your first bike?

A 5th grader's first bike is likely to be their current bike.
posted by jejune at 12:00 PM on April 22, 2008

Adding to the theme of "information a 5th grader would likely ask their parent to verify" but wouldn't likely to be known by his or her classmate: time of birth. Unless the kid is adopted, the mom will remember. Vividly.
posted by jamaro at 12:31 PM on April 22, 2008

If it's that unwavering, then their friends probably know about it. Also, you can't expect the kids to anticipate the problem with choosing a "favorite" that might change later on. "Well gee, I shouldn't use my favorite movie, as my current favorite movie is likely to be just a phase!" Kids don't think like that.

True, if you ask a fifth-grader any "favorites" question, chances are excellent that if the kid has friends and a favorite, the friends know what it is. They're also likely to know pet types and names, sibling sexes and ages and names, middle name(s), previous schools, previous teachers, what the kid calls grandparent(s) if any, what color bike they have if any, what their best friend's name is, what they want to be when they grow up, what color the rooms in their home are, and just about anything the kid can reliably answer about him or herself.

There is no easy answer to this. The best case scenario is to find questions that are a) inclusive (don't require a specific family configuration or lifestyle), b) reliably answered by the student, c) not reliably answered by strangers or the kid's "enemies" in school, d) fairly consistent over a period of time, presumably a year or school year, and e) changeable by the student at any time through an account management panel.

Beyond that, I think there has to be some give. It's not as if my best friend or sister couldn't answer most of the security questions posed to me by sites offering to retrieve my password or account information. Maybe the best bet is to have two questions and assume the likelihood of someone other than the student correctly guessing the answers to both is reduced.
posted by notashroom at 12:37 PM on April 22, 2008

Grandparents' first names, middle names, or birthdays. Parents' anniversary date.
posted by peep at 12:56 PM on April 22, 2008

Can you add a requirement to "double up" or even triple up on the password reset questions?

This way, even if a bad kid wants to reset somebody's account (and thereby take it over -- I bet 5th graders are all over this shit), he or she'd have to know a set of things about his target, not just one or two. This would certainly slow them down, but it might not be enough. All of these things could be socially hacked; they can come up innocently enough in conversation.
posted by zpousman at 2:10 PM on April 22, 2008

Fifth graders are in general not reliable. Security questions are therefore doomed.

You're building a site for school students, so your customer base has potential support from local administrative staff. That's simply not the case for sites like Gmail, which is why they rely on security questions to provide a user-driven password reset facility.

So just don't use security questions at all. Instead, build in a way to capture the student-teacher relationship, and give teachers the ability to reset their own students' passwords.
posted by flabdablet at 8:00 PM on April 22, 2008