Security questions are a human-authentication method leveraging unique private knowledge that only the valid user has and provide a reliable means for supplementary authentication. Security questions offer a low-cost alternative for password-resets and provide an additional layer of security beyond the traditional username-and-password protection method. In this survey paper, we review current literature on security questions, examine the issues on their use and identify the areas that need further research. The results of our review indicate that the current literature has acknowledged and discussed how security questions are susceptible to predominantly three types of attacks: blind guess, focused guess and observation. We found gaps in the literature in areas of using automated systems to provide real-time evaluation of responses and providing feedback to users to improve security. Finally, we outline potential directions for future research in using security questions more effectively.
['Andrew Mangle', 'Sandip C. Patel']
Issues in user authentication using security questions