Authentication via a series of questions

Sure, you can do this.

If truth be told, when I was a college student, I wrote an authentication system that worked by asking someone a number of questions that presumably only that person could know. It was clever and also had the benefit of a sense of humor -- after all, who can resist making the library of questions include, "What is your quest?" "What is your favorite color?" and the ever-popular "What is the capital of Assyria?" (for which there are at least two answers.)

There are a number of other places that similar mechanisms are used. For example, I'm a member of the Apple Developers' Program. If you forget your password on that, they ask you a series of authentication questions before letting you get back into your account.

In PGP, we have a way that you can reconstruct your key with a series of questions. It uses Blakely-Shamir key-splitting.

M-Tech has a question system for getting back a Windows password.

There are a number of issues associated with this sort of authentication. I use the word issue because they aren't problems, they're just things you have to keep track of.

Here's an example: Imagine that someone was born in San Francisco and wants to use that fact in one of their authentication questions. Here are accurate answers to "Where were you born?"

• California
• CA
• San Francisco
• San Francisco, California
• Fog City
• Frisco
• SF
• 94014

We have accurate but vague (California and CA), to specific, to whimsical (Fog City). The use of a ZIP code (94014) is also clever, especially as this is actually a ZIP code in Daly City.

The two issues are how do I, as a user, remember which one I put in, and how does the computer disambiguate. Should the computer consider either "San Francisco" or "SF" to be the same?

Also consider the threat model. Is this supposed to thwart accidental, casual or determined attacks? Thanks to the magic of the Internet, it's relatively easy to find out where someone was born. Thus, one gets more security from whimsical answers, but what happens if you forgot you used "Fog City" or "Home of the Niners"?

There's another issue in figuring out the value of a question and an answer. How do you measure the worth of "what is your favorite color" versus "what's your mother's maiden name"?

I hope this helps you think about it.