github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Support for Security Questions #51

New Issue
Closed
opened 2026-03-13 07:30:12 -05:00 by GiteaMirror · 9 comments
GiteaMirror commented 2026-03-13 07:30:12 -05:00
Owner
Copy Link

Originally created by @olivebishop on GitHub (Oct 7, 2024).

we all know securtity questions plays a crucial role in auth , we can have a security questions integrated within better auth so that on frontend we just fetch and update based on answers that were set by the user

Originally created by @olivebishop on GitHub (Oct 7, 2024). we all know securtity questions plays a crucial role in auth , we can have a security questions integrated within better auth so that on frontend we just fetch and update based on answers that were set by the user
GiteaMirror commented 2026-03-13 07:30:12 -05:00
Author
Owner
Copy Link

@luksch42 commented on GitHub (Oct 8, 2024):

I think we should stay with 2FA instead of security questions, as the latter are often guessable or easy to obtain. For example, in a casual conversation at a party, I could easily ask something like, 'Do you have pets?' followed by, 'What was its name?'—making it simple to uncover answers to common security questions.

@luksch42 commented on GitHub (Oct 8, 2024): I think we should stay with 2FA instead of security questions, as the latter are often guessable or easy to obtain. For example, in a casual conversation at a party, I could easily ask something like, 'Do you have pets?' followed by, 'What was its name?'—making it simple to uncover answers to common security questions.
GiteaMirror commented 2026-03-13 07:30:13 -05:00
Author
Owner
Copy Link

@olivebishop commented on GitHub (Oct 8, 2024):

@luksch42 i dont think so , take example a platform like upwork , they have security questions .... You MIGHT BE RIGHT though !

@olivebishop commented on GitHub (Oct 8, 2024): @luksch42 i dont think so , take example a platform like upwork , they have security questions .... You MIGHT BE RIGHT though !
GiteaMirror commented 2026-03-13 07:30:13 -05:00
Author
Owner
Copy Link

@tklein1801 commented on GitHub (Oct 8, 2024):

Are there no plugins for exactly this reason? I would suggest a plugin which will create two tables (name may vary)

  • security_questions
  • user_security_questions

and extending the router and api to support these requirements

@tklein1801 commented on GitHub (Oct 8, 2024): Are there no plugins for exactly this reason? I would suggest a plugin which will create two tables (name may vary) - `security_questions` - `user_security_questions` and extending the router and api to support these requirements
GiteaMirror commented 2026-03-13 07:30:14 -05:00
Author
Owner
Copy Link

@olivebishop commented on GitHub (Oct 8, 2024):

agree @tklein1801

@olivebishop commented on GitHub (Oct 8, 2024): agree @tklein1801
GiteaMirror commented 2026-03-13 07:30:14 -05:00
Author
Owner
Copy Link

@olivebishop commented on GitHub (Oct 9, 2024):

@Bekacru your take ?

@olivebishop commented on GitHub (Oct 9, 2024): @Bekacru your take ?
GiteaMirror commented 2026-03-13 07:30:14 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Oct 9, 2024):

@Bekacru your take ?

I'm fine with adding it as a plugin, but I don't think there are enough use cases to justify including it as a core 2FA method. If anyone wants to give it a try, I'm happy to help and merge.

@Bekacru commented on GitHub (Oct 9, 2024): > @Bekacru your take ? I'm fine with adding it as a plugin, but I don't think there are enough use cases to justify including it as a core 2FA method. If anyone wants to give it a try, I'm happy to help and merge.
GiteaMirror commented 2026-03-13 07:30:14 -05:00
Author
Owner
Copy Link

@olivebishop commented on GitHub (Oct 9, 2024):

ok

On Wed, Oct 9, 2024 at 5:20 PM Bereket Engida @.***>
wrote:

@Bekacru https://github.com/Bekacru your take ?

I'm fine with adding it as a plugin, but I don't think there are enough
use cases to justify including it as a core 2FA method. If anyone wants to
give it a try, I'm happy to help and merge.

—
Reply to this email directly, view it on GitHub
https://github.com/better-auth/better-auth/issues/120#issuecomment-2402486680,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AUNJ2Q6RGXKPSBT7LQGKETTZ2U3UVAVCNFSM6AAAAABPP5U2ZKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIMBSGQ4DMNRYGA
.
You are receiving this because you authored the thread.Message ID:
@.***>

@olivebishop commented on GitHub (Oct 9, 2024): ok On Wed, Oct 9, 2024 at 5:20 PM Bereket Engida ***@***.***> wrote: > @Bekacru <https://github.com/Bekacru> your take ? > > I'm fine with adding it as a plugin, but I don't think there are enough > use cases to justify including it as a core 2FA method. If anyone wants to > give it a try, I'm happy to help and merge. > > — > Reply to this email directly, view it on GitHub > <https://github.com/better-auth/better-auth/issues/120#issuecomment-2402486680>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AUNJ2Q6RGXKPSBT7LQGKETTZ2U3UVAVCNFSM6AAAAABPP5U2ZKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIMBSGQ4DMNRYGA> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >
GiteaMirror commented 2026-03-13 07:30:15 -05:00
Author
Owner
Copy Link

@itsderinger commented on GitHub (Nov 11, 2024):

FYI: "Knowledge-based authentication (KBA), sometimes referred to as “security questions”, is no longer recognized as an acceptable authenticator by SP 800-63" as KBA has an unacceptably high risk of successful use by an attacker (Source).

@itsderinger commented on GitHub (Nov 11, 2024): FYI: "Knowledge-based authentication (KBA), sometimes referred to as **“security questions”**, is no longer recognized as an acceptable authenticator by SP 800-63" as KBA has an unacceptably high risk of successful use by an attacker ([Source](https://pages.nist.gov/800-63-FAQ/#q-b07)).
GiteaMirror commented 2026-03-13 07:30:15 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Dec 2, 2024):

I'm going to close this issue there are currently no plans to add this on the core.

@Bekacru commented on GitHub (Dec 2, 2024): I'm going to close this issue there are currently no plans to add this on the core.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#51
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?