title: Best Practices for Security Questions in Web Apps
body: <p>I'm working on a web applications where - believe it or not- the users aren't required to provide their email address to sign up.  These requirements can not change.  The users will login to the system with an id and password just like any standard web site.  The problem I'm facing has to do with user's that have forgotten their password.  When they want to generate a new one, how do I verify their identity?</p>
  
  <p>Initially, I was going to make the users choose a security question (from a list of 5) and provide an answer.  If they ever entered the Forgot Password page, they would then have to enter their login id, as well as the answer to their security question.  This seems slightly insecure, as the answer to these types of questions (mother's maiden name, birth town, etc.) are generally not that hard to acquire.</p>
  
  <p>So here are some of my questions:</p>
  
  <ul>
  <li>Are security questions the best approach to this problem?</li>
  <li>If so, what are the best questions?</li>
  <li>How many questions should a user be required to enter the answers for?</li>
  <li>Is it necessary to put a CAPTCHA on the Forgot Password page?</li>
  <li>Is it better for users to generate their own questions?</li>
  </ul>
  
  <p>Any help/comments/literature on this matter would be greatly appreciated.</p>