Summary

Password hints and knowledge-based authentication, such as secret questions, should not be enabled.

Description

Password hints often offer enough information for an attacker to guess a users password. Answers to secret questions are sometimes information that is publicly available or that can be found on social media. Therefore, these mechanisms should not be part of the authentication process and should not be used in the password recovery process either.

References

• CWE-287. Improper authentication
• CWE-640. Weak password recovery mechanism for forgotten password
• CWE-1390. Weak Authentication
• NIST80063-5_1_1_2. Memorized secret verifiers
• CMMC-IA_L2-3_5_7. Password complexity
• IEC62443-IAC-1_7. Strength of password-based authentication
• IEC62443-CR-1_7. Strength of password-based authentication
• OSSTMM3-10_5_3. Telecommunications security (access verification) - Authentication
• NISTSSDF-PW_1_1. Design software to meet security requirements and mitigate security risks
• ISSAF-D_8. Network security - Password security testing (countermeasures)
• MVSP-2_4. Application design controls - Password policy
• ASVS-2_5_2. Credential recovery
• SIGLITE-SL_72. Is there a password policy for systems that transmit, process or store data that has been approved by management on all platforms?
• SIG-H_2_1. Access control
• CASA-2_10_1. Service Authentication