Should security question answers be hashed? Should security question answers be hashed? mysql mysql

Should security question answers be hashed?


Yes, but be sure to normalize it before hashing - lowercase it, consider removing all characters that aren't alphanumeric, etc. If I enter "ceejayoz" as my question, it should probably accept " CEEJAYOZ " as well.


Hashing it is a great idea, in my opinion. As no one really needs to know it other then the original user, so better to keep that more of a "Secret" from just prying eyes.

As far as the ability to change it, that is a great idea as well, and requiring him/her to enter their password to change it is another good security approach.

I think you are on the right track with your thinking.