Abstract or Summary:
Like it or not, security question password reset isn’t going away. Most organizations find it to be a cost effective approach that seems to work in practice. While there are many problems with this approach, one has received little attention: how to safely store the answers. I show that common methods used for storing password validation information are not suitable for security questions, and propose better alternatives.

PasswordResearch.com Note: Video of presentation: https://www.youtube.com/watch?v=CqwbCxP7MC0