Questions: Account Creation and Security

Question 1

A user creates an account with a complex 8-character password ('P@ss!123') and reuses it across 15 different websites. A hacker breaches one site and obtains the password. What is the attacker's most likely next move?

• A. Attempt to guess new passwords for the user's other accounts based on patterns
• B. Try the same stolen password on all the user's other accounts — a technique called credential stuffing
• C. Call the user pretending to be the breached website to obtain updated credentials
• D. Nothing — the password was complex enough that it won't work on other sites

Answer: (B)

Password reuse is the critical vulnerability here. When attackers obtain a breached password list, they immediately run it against other major services (email, banking, shopping) in automated attacks called credential stuffing. The complexity of the original password is irrelevant — they already have it. Unique passwords per site prevent one breach from cascading. A password manager solves this by generating and storing a different random password for every site.

Question 2

A security advisor says: 'Of all your accounts, your email account most urgently needs two-factor authentication.' Why is this specifically true?

• A. Email accounts store more sensitive personal information than any other account type
• B. Email controls password resets for most other accounts — access to email means access to nearly everything else
• C. Email providers have weaker authentication infrastructure than banks or financial services
• D. Email passwords are more likely to be stolen because they are transmitted in plain text

Answer: (B)

Email is the 'master key' of your digital life because most account recovery flows send reset links to your email address. If an attacker gains access to your email, they can click 'Forgot password' on every other service you use — banking, social media, shopping — and take over those accounts as well. This is why email should be the first account protected with 2FA and a strong unique password.

Question 3

A 16-character password made of four random common words is stronger against brute-force attacks than an 8-character password containing uppercase letters, numbers, and symbols.

• T. True
• F. False

Answer: True

Length is the dominant factor in password strength against automated attacks. Password cracking tools try billions of combinations per second, and the number of possible combinations grows exponentially with length. A 16-character password — even if made of recognizable words — has a vastly larger search space than an 8-character password. The symbol-and-number 8-character password feels 'strong' but is relatively short; the longer passphrase resists brute force far better.

Question 4

Security questions like 'What was your first pet's name?' provide strong account protection because that information is private and personal.

• T. True
• F. False

Answer: False

Security questions are often the weakest link in account security. The 'secret' answers — mother's maiden name, first car, childhood street — are frequently discoverable through social media profiles, public records, or social engineering. The professional approach is to treat security question answers like passwords: enter a random nonsense string for each answer (and store it in a password manager). This ensures that even if someone knows your real personal history, they cannot use it to reset your account.

Question 5

Why should security question answers be treated like passwords — entered as random nonsense and stored in a password manager — rather than answered honestly?

Model answer: Because the information security questions ask for — mother's maiden name, first pet, childhood address, first car — is often publicly available or discoverable through social media, public records, or casual conversation. An attacker who learns your real answers through social engineering or research can bypass your password entirely and reset the account. Using random nonsense answers that only you (and your password manager) know ensures the second factor cannot be defeated by someone who researches your background.

This flips the common intuition: people assume 'personal' information is private, but in practice it is often the most publicly accessible kind. Security questions were designed for an era before social media; today they are a weak link that adversaries specifically target. Treating them like passwords — opaque, random, stored securely — closes this vulnerability without sacrificing account recovery capability.