unhandledexception.net The first hurdle of the second new year’s resolution: logging on to Fidelity’s web site and being forced to waste 10 minutes of my time to create idiotic security questions. Wonderful.
The next prompt was to confirm my e-mail address, which was presented in all-caps. Although most e-mail systems aren’t case sensitive, displaying an e-mail in all-caps conveys that you’re a total idiot when it comes to computers.
After that, you have to go through selecting 5 predefined security questions. My favorite: The first name of my grandfather, and you’d understand why if you’re Greek: the first-born child usually bears the name of his grandfather.
Theoretically, these questions are additional passwords. They are very weak passwords, because they consist of answers to stupid questions that can easily be guessed by somebody who knows the slightest thing about you, let alone an ex-girlfriend looking for revenge. Even if they were strong passwords, they’d contribute nothing more to security than a password that meets proper length and complexity requirements. Sadly, I’ve seen a fair share of banking web sites that won’t enforce proper password complexity and length requirements. But they have security questions!
The reasoning for this? A widespread incorrect understanding of multi-factor authentication.
The final prompt in this process was a “thank you for helping us protect your account”! Very funny indeed, but thanks for warning me about your lack of computer security expertise.
