This past weekend, I attended what I like to call a "writers conference." (It was RadCon -- an event more properly called a "science fiction convention," but I went there as a writer, so let me cling to my euphemisms, okay?)

During a lull in the conference, I should have been working on red-lining the page proofs I'd received for Swordplay, which contains a short story of mine ("Last Man Standing"). Instead, I decided to create an account on Facebook, as I'd alluded to earlier.

Once on Facebook, I found a near and dear friend of mine who had posted to her "Notes" section a response to a couple of questionnaires that seem to be making the rounds. "Twenty-Five Random Things About You" and "The Name Game", where you answer questions based upon factoids about yourself.

These seem like really fun games to play, and I want to play. I want old friends of mine to have a chance to catch up with some of the tidbits I've collected in my life over the years. I want my old friends to find me. I intend to find a way to share what I can with them.

BUT.

So many of these fun little games can pose a security risk. I don't mean like, "Oh, Betty Sue from first grade might find out that I've converted to Pastafarianism and now will use that information against me to spoil my relationships with our mutual friends from first grade who have since become religious fundamentalists." Rather, I mean, "Oh, I mentioned the name of my first pet, and that's the security question on my credit card accounts."

I've written a bit more extensively on the topic of "breaking and entering" into your identity using this kind of information. Please take a look at my previous blog post on the subject. But, let me repeat part of it here:

If someone wants to get at your online identity, your weakest link (and therefore your greatest vulnerability) is probably your security question.

Many online data warehouses will, if you "forgot your password", simply e-mail your password or a password-reset link to your e-mail address. As long as you have reasonably good control over your e-mail address, that's fine. But many online data warehouses will, instead, ask a security question (possibly even one that you have picked). Upon successfully answering the question, *anyone* can be given complete access to *your* online identity.

This is particularly problematic for AOL and the major blog networks, where the user ID is already public. If Johnny Badguy wants to hijack your blog on BlogJournal, and he knows (isn't it always a 'he'?) that your blog belongs to "Victim-American", then he already knows the login ID to use. When asked the security question, well... all he has to do is look it up on the web, no?

It's like this: Johnny Badguy types in your login ID and clicks on "I forgot my password." He is then asked, "What year did you graduate college?" He then searches your blog (or elsewhere on the internet, as appropriate) for any references to your age, deduces what year you probably graduated, and then he's in. "What's your mother's maiden name?" He looks for any references you may have made to your grandparents. "Where were you born?" Again, not usually all that hard to find the clues necessary to come up with the answer.

I've been meaning for some time now to post an essay about an old car I owned, but I know I used that as a security question/answer for something, and until I track down what it was, I'm reticent to share that online....

So, yeah. One of these days, I'll probably join y'all in the "Twenty-Five Random Facts About Me" game. But I strongly encourage you to make sure you are not sharing any information that you have used as the answer to a security question on any of your bank, credit, or online accounts.

By the way... will you be my friend?