Security gripes

[moonman239]

I tried to make a purchase from my phone today, but couldn't remember how to answer the security questions. One problem is that I couldn't remember how I answered my first-teacher question. Another is that I misread the next question.

My main gripe is this: There are so many ways to phrase the answer to some of the questions. For example, for the first-teacher question, I could have typed in "Jane Doe," "Jane," "Mrs. Doe," or perhaps "Mrs. Jane Doe." (Don't even try any of those answers on my account; you'll fail if you do.) Or, if a city's involved, I could have put "Anytown, NY" or "Anytown, New York."

My point is that the server should be smart enough to know that Mrs. Doe is Jane Doe and that Anytown, NY is the same city as Anytown, New York.

Here's my second gripe: if I forget these answers, I have to contact Apple Support. Why can't I just have them send me an email to my rescue account, send a text message to my cell phone, and/or ask me when I was born?

Better yet, they could have me authenticate myself using the Touch ID sensor on my phone.

 

[GGJstudios]

My point is that the server should be smart enough to know that Mrs. Doe is Jane Doe and that Anytown, NY is the same city as Anytown, New York.

Such "guesswork" on the part of the server would make it easier to compromise your account. It's the user's responsibility to remember answers given to security questions. After all, the user gets to choose them.

Here's my second gripe: if I forget these answers, I have to contact Apple Support. Why can't I just have them send me an email to my rescue account, send a text message to my cell phone, and/or ask me when I was born?

You're complaining that their security is robust. That's exactly what you should be wanting. Your email account and DOB can easily be compromised.

It's not Apple's fault that you forget your password or answers to security questions.

 

[moonman239]

Such "guesswork" on the part of the server would make it easier to compromise your account. It's the user's responsibility to remember answers given to security questions. After all, the user gets to choose them.

You're complaining that their security is robust. That's exactly what you should be wanting. Your email account and DOB can easily be compromised.

It's not Apple's fault that you forget your password or answers to security questions.

I want robust security, but I also want the server to at least be smart enough to know that "Anytown NY" = "Anytown, NY" = "Anytown, New York." The point is, if I show that I know who my first teacher was, and where my favorite job was, that should be good enough.

Anyways, I'd be fine with a text message or Touch ID authentication (yes, it can be broken, but using it requires both physical access and a lot of time.)

 

[Primejimbo]

Just set this up and no more answers to questions anymore
http://support.apple.com/en-us/HT204152

 

[moonman239]

Just found the answers:

-2-step verification
-Email to recovery email address if I forget my security answers. (via Website)

 

[Apple_Robert]

I tried to make a purchase from my phone today, but couldn't remember how to answer the security questions. One problem is that I couldn't remember how I answered my first-teacher question. Another is that I misread the next question.

My main gripe is this: There are so many ways to phrase the answer to some of the questions. For example, for the first-teacher question, I could have typed in "Jane Doe," "Jane," "Mrs. Doe," or perhaps "Mrs. Jane Doe." (Don't even try any of those answers on my account; you'll fail if you do.) Or, if a city's involved, I could have put "Anytown, NY" or "Anytown, New York."

My point is that the server should be smart enough to know that Mrs. Doe is Jane Doe and that Anytown, NY is the same city as Anytown, New York.

Here's my second gripe: if I forget these answers, I have to contact Apple Support. Why can't I just have them send me an email to my rescue account, send a text message to my cell phone, and/or ask me when I was born?

Better yet, they could have me authenticate myself using the Touch ID sensor on my phone.

Why not use a program like 1Password, so that you can create secure notes and manage passwords etc? It would work well in instances like this, where you have 3 different questions to answer. That way you don't have to remember some obscure phrase answer and can easily retrieve it when being prompted by Apple.