Research for my recent article on banking online sent me down memory lane, in a way, and I found myself revisiting some of the frustrations I felt in a recent attempt to manage my finances on the web.

Many of you are probably aware of a recent, U.S.-wide implementation of a secret question/answer system, which compliments banks' more traditional username/password box. I say this because two out of the three banks I use – Citibank, as well as my local credit union – implemented this system at roughly the same time, and almost exactly the same way: by presenting me with a list of ridiculous secret questions, and making me supply secret answers. Three times each. (Additional research I did at the time revealed that there was, in fact, a large-scale initiative – though its name eludes me right now.)

The point of all this, of course, is to add an additional means of authenticating oneself (“two-factor authentication”) when the bank detects “unusual” activity. From my own experience, “unusual” seems to be a change in IP address – evidenced mainly by the fact that ever since I reactivated my Mint.com account, I now have to answer these annoying little prompts almost every couple of days.

Secret questions are an oddity, and what they ask runs the gamut of different possibilities. Herein lies the first problem: many of the questions are poorly thought out. At best, they simply don’t apply to the user. At worst, their answers are difficult and nuanced.

For example, here’s one of the choices I was presented: “What is the brand of car you learned to drive in?”  That’s hard to say – my driving lessons were evenly divided between two cars: my Mom’s Aerostar, and my Dad’s black Volvo. Moreover, I learned to drive a stick shift in my first car – a squirrelly little Honda Civic with the world’s most unforgiving manual transmission. See? Already, I have three answers. Further compounding this was petty semantics: should I put “Ford Aerostar” or just “Aerostar”? Which one was I more likely to enter if I forgot about the question completely? What if someone wants to answer “1992 Blue Ford Aerostar”? Should they be expected to remember the answer in both its complexity and the order of its descriptors, in addition to their login name (account number, in my case) and password?

Scrolling through the list of possible secret questions, I realized about half of them were either nuanced, like the example above, or simply too easy for someone to guess. The other half simply didn’t apply to me: “When was your first mortgage?” I’ve never owned a house. “What restaurant was your wedding rehearsal dinner held?” I’m unmarried. “What nickname did you have for your grandmother?” I never knew my grandmother – oh, and thanks for reminding me of that fact.

I ended up picking three questions that I had to pick my brain to answer, and all of the questions were nuanced in such way that the correct answer could take half a dozen different forms. One day I found myself locked out of my account until the system gave me a different question – a day later.

My second big problem was connecting these newly-protected accounts to third party services – Mint, namely. As my Mint account stopped working a few weeks prior due to these secret question hysterics, I had to reenter all this information into my Mint account. Once again, I was presented with the same list of questions and had to enter the same exact answers – except this time, if I entered anything wrong then my Mint account would stop working. Even worse: my bank refused to divulge the secret questions I had – somewhat whimsically – chosen. I ended up getting around this by recording my secret questions and answers as I encountered them over the next week, and then finally returning to Mint to fill them in.

While I understand the need for increased security, the product of these concerns is a system that is annoying, cumbersome, and impeding to functionality: We’ve solved the username/password problem, but the solution is so much worse that, frankly, I would rather we went back to passwords. The way I understand it, secret questions are primarily designed to thwart phishers and other attackers who only know your login credentials. What’s to stop these people from phishing for your secret question and answer as well? It would be very easy for all those fake “account maintenance” web pages add a couple of additional questions.

Besides, what if the victim’s attacker is a jilted lover? A divorced spouse? A once-trusted friend?

And, of course, let’s not forget how Paris Hilton’s T-Mobile was hacked.

Now, I don’t claim to be an expert in security – at least not in the “certified” sense. I do know a thing or two, however, as most anyone who’s heard the stories I tell can attest. You don’t have to believe me when I tell you that a secret question is the wrong answer to our current security woes – but I would advise believing esteemed security expert Bruce Schneier (“Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem…”), who presents a far more authoritative argument.

In a nutshell, Schneier accuses banks of backing a normal security protocol (a password) with a “much less secure protocol” (secret questions).

“It's a great idea from a customer service perspective – a user is less likely to forget his first pet's name than some random password – but terrible for security. The answer to the secret question is much easier to guess than a good password, and the information is much more public,” he writes.

I agree. Neither of us have a good answer, however. I am a fan of passphrases, but those can be phished just as easily as a password. There are other forms of two-factor authentication: maybe we could standardize on a nifty little keychain that spits out a number once a minute. (Don’t lose your keys!) Or, perhaps, we could present our financial institutions with a thumbprint for use with a home-based fingerprint scanner – but again, this requires standardization, and probably more than a little expense.