ASVS 5.0 V6.4.2 says your application must not offer password hints or knowledge based authentication, the "secret questions" such as mother's maiden name. It is a Level 1 requirement. Recovery should rely on something the user holds, like a verified email link or an enrolled authenticator, not on facts about their life.
Why it matters
Answers to "first school" or "favorite teacher" are in social profiles, data breaches and public records. They are also low entropy, so an attacker can guess them. A hint field makes it worse: users write things like "dog + year", which narrows the search and sometimes contains the password itself.
A secret question is effectively a second, weaker password that bypasses your real one.
How to implement it
Remove the feature rather than hide it.
- Delete hint and question fields from the signup, profile and recovery screens.
- Drop the columns and stop accepting the parameters on the API.
- Build recovery on a single use reset link sent to a verified address, plus MFA where enabled (see V6.4.3).
If you migrate an old system, run a one time cleanup.
ALTER TABLE users DROP COLUMN password_hint;
DROP TABLE IF EXISTS security_questions;
DROP TABLE IF EXISTS security_question_answers;
Reject the old fields at the edge so a stale client cannot reintroduce them:
FORBIDDEN_FIELDS = {"password_hint", "security_question", "security_answer"}
def reject_legacy_fields(payload: dict):
if FORBIDDEN_FIELDS & payload.keys():
raise BadRequest("Unsupported field")
How to test it
- Walk through registration, profile settings and forgot password and look for any question or hint prompt.
- Search the codebase and schema for
hint,security_questionandmaiden. - Send a registration request that includes a hint parameter and confirm it is rejected or ignored and not stored.
Common mistakes
- Keeping the questions "as an extra step" during recovery.
- Rebranding them as "verification questions".
- Leaving the old database columns populated after removing the UI.
- Letting support agents use personal facts to verify callers into account recovery.
Quick check
Is asking for date of birth during recovery allowed?
It is knowledge based authentication and easy to find, so it does not meet the intent of V6.4.2 as a recovery factor.
