About this question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An account password reset process I'm working on works in three steps. The first step asks the user to provide three pieces of identifiable information, including their username, birth date, and identification number. Once they've passed that check, they are asked their security question(s) (which they set up previously). If they've passed that check, they set up a new password.
So, should we require case-sensitivity on the security question? Some internal discussion is pointing us in the direction of "no." One justification we have come up with is, say we used that same security question if the user called us as a check to verify their identity. If they get the answer right, they get the answer right. They're not spelling out the case of the answer to us verbally. So, should we do it on a web form?
I can't seem to find an "industry standard" or a "best practice", so I'm hoping to get some feedback from people with experience in this practice or from security matter experts.
