JiLi333 Security Question Advice: Answers Nobody Can Look Up
A security question is weak because the true answer is often public or guessable, which is why NIST's SP 800-63B tells services not to prompt for them.
Key facts and contents
- JiLi333 Change Password Steps
- To change a password safely, start with the account that can reset the others, your main e-mail or Google or Apple account, using a new password you have never used.
- JiLi333 Password Generator
- You do not need a password generator website.
- JiLi333 Password Checker
- Use the password checker already in your password manager: Google's Password Checkup in Chrome and Google Password Manager, or the iPhone Passwords app's alerts.
- JiLi333 Too Many Login Attempts
- An account usually locks after too many wrong passwords, a security hold on a suspicious sign-in, or a lost or changed phone number.
A security question looks like a safety net and often works like a back door. “What was the name of your first pet?” has one true answer, and that answer may sit in an old social media post, a family photo caption or a friend’s memory. This page explains why the method is weak, how to make an answer that cannot be guessed, and what to rely on instead; the stronger account recovery options covers the stronger options.
Why a security question is weak
NIST’s SP 800-63B, the United States federal guidance on digital identity and passwords, says services shall not prompt users to use knowledge-based authentication, its example being “What was the name of your first pet?”, or security questions when choosing passwords. The reasons are easy to see:
| Weakness | Example |
|---|---|
| The answer is public | A school name listed on a social profile |
| The answer is guessable | A favourite colour from a short list of common ones |
| The answer is known to others | A mother’s maiden name known across the family |
| The answer never changes | A birthplace cannot be reset after a leak |
How to answer one so it cannot be guessed
If a service still insists on a question, do not tell it the truth:
- Pick the question, then ignore what it asks.
- Let your password manager create a random answer, the same way the phone’s password generator makes a password.
- Save the answer in the manager, in the notes for that account.
- If the service reads answers aloud over the phone, use a random phrase of real words instead of symbols, so you can say it.
What to use instead of a security question
Stronger recovery options exist on the accounts that matter most:
- Google offers a recovery phone, a recovery e-mail, recovery contacts and backup codes.
- Apple offers recovery contacts who can give you a code.
- A JiLi333 login recovers through its Forgot Password screen, which starts with Verify identity and the +63 mobile number you registered with, so keeping that number active is your recovery plan there.
When a security question has already leaked
Change the answer the way you would change a password, and treat the old answer as public from now on:
- Replace the answer with a random one from your password manager.
- Check the account’s recovery phone and e-mail.
- Change the password too if the leak came with it.
The change password order show the order to work through your accounts, starting with the e-mail that receives every other reset link.
FAQ
Are security questions safe?
Not as usually answered. Your first school or mother's maiden name can be found or guessed, and NIST's password guidance tells services not to prompt for knowledge-based questions such as the name of your first pet.
What is a good answer to a security question?
A random string or phrase that has nothing to do with the question, saved in your password manager next to that account. Treat it like a second password.
Does JiLi333 use a security question?
The JiLi333 register panel asks only for a +63 mobile number, a password, a confirmation and a human check, and Forgot Password starts with Verify identity using that number. No security question appears on those signed-out screens.