You set a twenty-character password and enabled a second factor. Then the service asked for a security question, and you honestly answered that your first dog was called Rex. Congratulations: the account now has a spare entrance with a three-letter password that half your acquaintances know.
Por qué es el punto débil
A security question is a bypass around all your protection. It exists precisely to let someone in without a password, and often without the second factor too. So the strength of the account equals the strength of its weakest entrance, not its strongest.
And the strength of typical answers is close to zero. A mother’s maiden name is on social media and in relative lists. A city of birth is in a profile. A pet’s name is in a photo caption. The make of a first car is guessable in three attempts from region and age.
Worse, many questions have few possible answers in principle. “Favourite colour” is a search across ten words.
Qué hacer
Answer untruthfully. The simplest and most effective step. “Your first pet’s name” does not oblige you to be honest — the service merely compares a string. An answer like “mKq7-veranda-9” works exactly as well as “Rex” and is not findable on social media.
Keep the answer in a password manager. An invented answer is impossible to recall two years later — which is exactly when you will need it. Store it beside the password, in the notes field. Without that, the whole trick becomes a way of losing access permanently.
Use a generator. A passphrase of three or four words works well: it can be read out to a support operator over the phone but cannot be guessed.
Decline where possible. Some services let you skip security questions entirely or replace them with backup codes. Backup codes are better: they are one-time and not tied to guessable facts.
Un caso especial: soporte telefónico
Sometimes a live operator asks the question. Here an invented answer creates friction: “mKq7-veranda-9” is painful to dictate and easy for the operator to mistype.
The solution is an answer made of ordinary words unrelated to you: “blue kettle thirty” instead of a dog’s name. Easy to dictate, not searchable, and no need to memorise it because it lives in the manager.
Revisa tus cuentas antiguas
You most likely set security questions many years ago, and honestly. It is worth going through the important ones — email, banking, government services — and looking at what is there.
If the answers are truthful, replace them with invented ones and save them in the manager. Half an hour of work closes the most underrated route to account theft: not password guessing, but a recovery performed by someone who knows slightly more about you than you assumed.