Insecurity Questions



As a member of my small city’s Bicycle and Pedestrian Advisory Commission, I am required by California Law once a year to disclose any conflicts of interest I may have. The City has recently adopted eDisclosure, a system to allow us to file those disclosures online.

I was sent a temporary password with which to create an eDisclosure account. It required that I change my password immediately, and had a moderately aggressive set of password rules:

But it also required me to answer a single “security” question, and none of the prompts inspire confidence in the security of this system:

“What is your favorite season?” has to be one of the lowest entropy questions I have seen yet. Of course, there are four seasons, so if they are equally popular that is a whopping 2 bits of entropy. Of course, there are other answers, like “ski”, “strawberry”, and “football”, but I only thought of those once I realized how few choices there seemed to be. Many will just answer, “spring”.

My favorite season, of course, is unpronouncable.

 Contributed by myself (Jim Fenton)