To determine if someone other than the user who needs to reset a user ID or password might be able to answer security access questions to accomplish the reset, I conducted a quantitative study survey that resulted in responses from 390 people with different levels of expertise in computer use. The results show that for most of these common password reset questions, participants knew the answer for one or more persons.
MoallemA. (2011). Did you forget your password? In MarcusA. (Ed.), Design, user experience, and usability, Pt II, HCII, 2011, LNCS 6770 (pp. 29–39). Berlin, Germany: Springer-Verlag.
4.
SchechterS.Bernheim BrushA. J.EgelmanS. (2009). It’s no secret: Measuring the security and reliability of authentication via “secret” questions. In Proceedings of the 30th IEEE Symposium on Security and Privacy (pp. 375–390). Piscataway, NJ: IEEE.
