henhouse/tracker — Issue #32: Secret Question / Answer
Author: subwai
Created: 2012-02-12 15:11:00+00:00
State: open

In the quest of securing smolderforge's users!

Those who share accounts should still be able to regain their accounts even tho someone has changed their email & password.

Secret answer should be stored as a sha1 hash. However, the question must be stored in clear text.
Do we want a list of possible secret questions or should they enter the question themselves?

Big sites are using predefined questions to get the best question possible by theese characteristics:

cannot be easily guessed or researched (safe),
doesn't change over time (stable),
is memorable,
is definitive or simple.

Imo, they should chose themselves tho since it could give a more personal impact.