「秘密の合言葉」ってセキュリティ大丈夫？？？ #251
While trying to log in to JCB's MyJCB portal, the host was stopped by a "secret question" prompt asking for their favorite fruit—and couldn't get in no matter what they typed. In an era when passkeys are going mainstream, the episode digs into why this discredited authentication method is still in active use, and how JCB ended up deploying it in 2016, the year after Google proved it was broken.
Listen to this episode Go to the show page
What this episode answers
Why are secret questions considered a security problem?
Secret questions trap users in a structural dilemma: questions with predictable answers are easy to guess, while questions with unpredictable answers are ones users can't remember, so they enter random nonsense—and OWASP flatly states there are "no acceptable uses" for them.
What did Google's large-scale 2015 study reveal about secret questions?
19.7% of answers to "What is your favorite food?" were "pizza," meaning typing that single word would break into roughly one in five accounts; the paper's title, "Secrets, Lies, and Account Recovery," captures the core problem: hard-to-guess answers are also hard to remember, so users start lying.
What real-world hacking incident exploited secret questions?
During the 2008 U.S. presidential race, a college student with no hacking experience cracked Alaska Governor Sarah Palin's Yahoo Mail account in 45 minutes by looking up the answer to her secret question—"Where did you meet your spouse?"—on Wikipedia and typing in the high school name.
Why did JCB introduce secret questions in 2016?
JCB did not reply to a direct email inquiry, so the cause remains speculative; the leading theories are either a manager who overruled a safer email-verification proposal, or a vendor delivering a legacy system with the feature already built in.
What is the right way to handle a site that demands a secret question answer?
Security experts recommend entering a random string generated by a password manager—never an actual memorable answer—and letting the manager store it; the long-term solution is migrating to passkeys, which store a private key on-device and remove any reliance on human memory.
"What's Your Favorite Fruit?" — A Rude Reminder That Secret Questions Still Exist
Trying to log in to JCB's MyJCB portal, the host was stopped by a "secret question" prompt: "What is your favorite fruit?" Entering peach, pear, and strawberry all returned "Incorrect," and the site eventually pushed them toward a one-time password sent by email. In an age when passkeys are becoming commonplace, this experience raised an obvious question: why is this method still live?
Why Secret Questions Are Bad Security
The problem is a structural dilemma with no clean exit. Questions with a small answer space—"What's your favorite fruit?" or "What's your favorite food?"—are trivial to guess. Questions with large answer spaces—"What is your frequent-flyer number?"—are ones users cannot reliably recall, so they type something random.
Google's 2015 study of hundreds of millions of accounts found that 19.7% of answers to "What is your favorite food?" were "pizza." On any English-language site using that question, simply entering "pizza" would break into roughly one in five accounts. The paper's title—*Secrets, Lies, and Account Recovery*—says it plainly: answers that resist guessing are forgotten, so users start lying, and the resulting nonsense entries leave accounts wide open.
The security organization OWASP is categorical: "There are no acceptable uses." Secret questions are listed alongside the practice of emailing a document's password in a separate message as a canonical example of security theater—the look of security without any of the substance.
The Sarah Palin Hack — An Amateur College Student, 45 Minutes
During the 2008 U.S. presidential race, the Yahoo Mail account of Alaska Governor and Republican vice-presidential nominee Sarah Palin (サラ・ペイリン) was hijacked by a college student with no hacking experience in just 45 minutes.
The method required no technical skill. Using the "Forgot password?" flow, the student reached a secret question: "Where did you meet your spouse?" He opened Palin's Wikipedia page, confirmed that she had stated in interviews that she met her husband in high school, typed the school name, and was in. The incident also shows the risk extends beyond public figures: a local acquaintance who knows your elementary school or hometown could do the same.
What made the attack especially destructive was that the secret question sat inside the password-reset flow—allowing a full bypass of the ID-and-password authentication the account actually relied on. Using secret questions for account recovery is considered the most dangerous deployment possible.
Why Did JCB Introduce This in 2016?
JCB was contacted directly by email but did not respond, so the explanation remains speculative. The leading theory is the "stubborn-manager hypothesis": a staff member proposed email-based two-step verification, but a manager overruled them—"users might not remember which email address they registered, so a secret question is safer." A second possibility is a vendor explanation: JCB may have received an off-the-shelf legacy system with the feature already built in.
The situation is made stranger by the fact that MyJCB already includes an email one-time password option. Yet the design treats the secret question as the primary method and email as a fallback. Email address is an optional field during registration; the secret question is mandatory—exactly the reverse of what security logic would prescribe. Launching the feature in 2016, the year after Google had already shown that "pizza" unlocks one in five accounts, and then relegating the safer email option to secondary status, earned the design a slot among the "seven mysteries of Japanese corporate websites."
What to Do Instead — Passkeys, and a Workaround When You're Stuck
The fundamental fix is passkeys. Because a private key is stored on-device and unlocked by Face ID or equivalent biometrics, users never have to memorize anything. If many security failures trace back to the limits of human memory, passkeys eliminate that weakness at the architectural level.
When a site forces you to register a secret question answer, security experts recommend entering a random string from a password manager—something like "hash203071" in response to "What is your favorite fruit?"—and letting the manager store it. Never treat a secret question as an actual secret question.
For MyJCB users specifically, the practical advice is to register an email address and then, when the secret-question screen appears at login, click the "Send a one-time password to my email" link and authenticate via email instead.
Takeaways
- Google's 2015 study found that 19.7% of answers to "What is your favorite food?" were "pizza," and OWASP states there are "no acceptable uses" for secret questions—placing them squarely in the category of security theater.
- In 2008, a college student with no hacking experience cracked Sarah Palin's Yahoo Mail in 45 minutes by looking up her secret-question answer on Wikipedia, demonstrating that using secret questions in password-reset flows is the most dangerous possible application.
- When forced to register a secret question, security experts recommend storing a random password-manager-generated string as the answer rather than anything memorable; the permanent solution is adopting passkeys, which remove human memory from the authentication chain entirely.
This article is edited from a machine transcript of the first 30 minutes of the episode. It is not an official summary — please listen to the episode itself.