Analyzing 4 Million Real-World Personal Knowledge Questions

No ratings

Presented at passwords 2015 by

Markus Dürmuth

Maximilian Golla

Personal Knowledge Questions are widely used for fallback authentication, i.e., recovering access to an account when the primary means of authentication is lost. It is well-known that the answers have low-entropy only, and are sometimes derivable from other data sources, but ease-of-use and supposedly good memorability seem to out-weight this drawback for some applications. In August 2015, hackers published a database dump of a famous online dating website, including 3.9 million plain text answers to personal knowledge questions, among other data, making it the largest of such publicly available lists. We analyzed this list of answers and were able to confirm previous findings that were obtained on non-public lists (WWW 2015), in particular we found that some users don't answer truthfully, which may actually reduce the answer's entropy.