I propose that we have new tags for with a synonym of to be used for questions about those annoying favorite-pet or mother-maiden-name kind of questions that are an outdated and ineffective form of authentication.

If the community decides not to create the tag (e.g. there is no reason to use sec. Qs at all), we should probably redirect posts to a canonical post explaining the reasoning.

Here is an incomplete list of posts that should be tagged (or dupe-hammered):

Yahoo asked me to remove my security questions and said I was more secure.

How do security questions work?

Do security questions subvert passwords?

Why does OWASP recommend security questions?

Should security question answers be case-sensitive?


I think the topic of security questions - e.g. whats your mother maiden name - is distcint enough to merit it's own tag. The fact that there are many duplicates indicate the need for a tag, because clearly both askers and close voters have trouble finding the duplicates.

The fact that there's already an authentication tag is irrelevant. That tag is huge, and is not a reason for not having more specific tags for sub topics.

The only problem here, really, is what the tag should be called...

  • will just be misunderstood and we'll have to spend years editing it out from questions where it don't belong. No tag wiki in the world will solve that.
  • is funny because it's true. But tag names should describe the topic, not make a point.

Any suggestions?

  • 3
    despite me answering with the opposing view, you tell a compelling story. Have an upvote. – Rory Alsop Jan 4 '18 at 10:46
  • 1
    @RoryAlsop, the world is better when mods are humble like that. – NH. Jan 4 '18 at 21:15

I'd propose to call it .

That term seems to be used sometimes, like here or here and might be less ambiguous than which is hopefully enough to stop generic abuse.

The tag wiki should then clarify that tagged questions are about those security questions that are often used as an extra authentication layer e.g. when requesting a password reset.

  • Sounds great to me! – Anders Jan 6 '18 at 19:25
  • I'll take that. In fact, when the answers to the questions are actually secret (because they are random rather than real), these things aren't so bad. – NH. Jan 7 '18 at 1:21
  • 1
    Since some time has passed and nobody seemed to object to this proposal, I took the liberty of creating this tag and tagging some questions with it. There are probably more, and I am sure the usage guidance can be improved as well if someone wants to. – Anders Jan 24 '18 at 22:32

Every question on this site should be a security question. Hence there is absolutely no need for a tag on it - it would add no value at all. And by association, an tag makes no sense either.

The questions you propose using it for are already tagged , which is the correct tag here.

I think we may have blacklisted security and security-questions in the past.

  • 3
    I think NH means questions about the security questions that services ask when resetting passwords or verifying user ("What was your first car?") – schroeder Dec 29 '17 at 10:38
  • Those are all covered under Authentication. You know a security-questions tag would just cause confusion :-) – Rory Alsop Dec 29 '17 at 10:39
  • That's why we make it a synonym for insecurity-questions, and make the tag wiki of the latter explicit. Recall the big notice at the top of security-theater... – NH. Dec 29 '17 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .