My favorite color, by the way, is black. Or at least it will be until something darker comes along.

While marginally better than asking for personal information that is just as easily discovered on the web —your mother’s maiden name, where you were born (my mother claims it was in a barn based on my habit of leaving doors open as a child), what high school you graduated from—the fact remains that these questions are useless for verifying identity.

Seriously, how many colors are there? And how many of us share the same love of one of those limited choices?

The answers to these questions aren’t that hard to guess in case a quick search doesn’t turn them up. Because, while we’re great at sharing, we aren’t so great at managing admittedly confusing privacy settings on social media, and some things are a matter of public record. Check an obituary sometime. You’ll quickly find not only my maiden name, but my mother’s maiden name and the names of all my siblings and their children and… See, it’s not that hard to find information if you know where to look. A new upcoming breach trends research report by F5 Labs, studies data breaches over the past decade and concludes that “There have been so many breaches that attacker databases are enrichened to the point where they can impersonate an individual and answer secret questions to get direct access to accounts without ever having to work through the impacted party.”

It is also true that passwords are not enough. Credential stuffing¹ is a real threat, and the upcoming F5 Labs breach trends report discovered that 33% of the breaches started with identity attacks, of which phishing was the primary root cause. Many of the malicious URLs clicked on, or malware files opened, in phishing attacks collect credentials, which are then sold and used to gain illicit access to corporate systems.