Interesting read, my fiance’ was talking about the “25 random things about me” email on facebook the other day. I’ve often wondered about these “authentication questions”. It seems that most of the information used to authenticate is pretty readily available regardless of some survey you might have done on facebook. I really believe that you cannot be afraid of technology and succeed in business today. But that statement needs to be tempered with common sense on the parts of the end user and IT.

The gist being that people should understand how ubiquitous anything they post on the internet can become. But IT should understand that too and develop authentication methodologies that protect against it.

I once had a credit report agency use detailed information from my loan history and credit history to authenticate me. I was impressed, the questions were a lot harder but I did feel a lot safer as a result. They had special access to that information to formulate questions though.

So the real task is what information is so ubiquitous that everyone who needs access to it to formulate questions has access but yet so protected that it isn’t available to identity thieves?