Security Question Strength Warning

WHAT IT DOES This script detects security question fields on account settings and registration pages, analyzes both the question and answer for common weaknesses, and displays a floating warning panel. It flags weak question/answer combinations—questions like "mother's maiden name," "pet's name," "birthplace," or "high school" are marked as high-risk because the answers are often publicly available or easily guessable. The panel shows a strength rating for each question-answer pair, including a score percentage and color-coded status (green = strong, yellow = medium, red = weak). It provides detailed feedback on why an answer is weak (e.g., single word, all lowercase, no numbers) and offers actionable tips for creating stronger security answers. A list of common weak questions and their risk categories helps you understand what to avoid. All data is stored locally. WHERE IT RUNS Works on any account settings, registration, or profile page that uses security questions—email services, banking portals, social media, e-commerce sites, or any service that uses knowledge-based authentication. The script scans for select dropdowns and text input fields with associated labels to detect security questions automatically. HOW TO USE The panel appears automatically when you visit a page with security questions. It shows how many questions were detected and their risk levels (high/medium/low). Click on any question card to see its category and, if an answer is entered, its strength score with specific issues highlighted. The panel provides a "Tips" section with 5 actionable recommendations for creating strong security answers. For pages with high-risk questions, you can click "Dismiss Warning" to hide the reminder for that domain or "Mark as Reviewed" if you've already reviewed the questions. Use the "Reset preference" button on dismissed warnings to re-enable the reminder for that domain. TECHNICAL MECHANISM: TWO-PASS QUESTION DETECTION WITH RISK CLASSIFICATION AND ANSWER STRENGTH ANALYSIS The script uses a multi-pronged detection strategy. First, it scans all select elements on the page, checking each option's text against a database of over 35 known weak security question patterns using case-insensitive regular expressions. Each question is classified by category (family, personal, education, preference, sensitive) and risk level (low/medium/high/critical). Second, it scans all text inputs and uses label association (for/id relationship or parent label) to identify the question text. It also scans surrounding div/p/li/span containers for question-like text near text inputs. For any detected question with an associated answer input, the script analyzes the answer using a scoring algorithm that checks for weak patterns (single common word, month name, day of week, season, numeric-only, very short length), length, character diversity (uppercase/lowercase/numbers/special characters), and common password-like words. Each check deducts points from a starting score of 100, with bonus points for spaces and multiple words. The final score (0-100) maps to strength categories: weak (70). Dismissal preferences are stored per domain in GM_setValue with two statuses: "dismissed" (hide reminder) and "reviewed" (mark as acknowledged). THE PANEL The security question warning appears in a draggable, resizable panel that remembers its position per site. The panel shows a summary card with total questions and high/medium risk counts, followed by individual question cards with risk badges and category labels. For answers, it shows a strength percentage and color-coded status with detailed issue list. Drag by the header to reposition, collapse to a compact icon with a click, and resize using the bottom-right corner. The panel snaps to screen edges for tidy placement and closes with the Escape key. All settings—dismissal status per domain and panel position—persist per website using GM_setValue, so your view returns exactly as you left it. PLEASE NOTE This script requires the free BotGentz extension to run. The script reads page content to detect security questions and answers—it never captures or transmits any data. All analysis is performed locally in your browser. The script does not read password fields or sensitive data beyond security question text and answers as typed. The detection database includes over 35 common weak question patterns but may not cover all variations. The answer strength analysis is heuristic and should be used as a guideline, not a definitive security assessment. For sensitive accounts, consider using a password manager with security question storage or avoiding security questions entirely in favor of 2FA where possible.