Personal Knowledge Questions are widely used for fallback authentication, i. e., recovering access to an account when the primary authenticator is lost. It is well known that the answers only have lowentropy and are sometimes derivable from public data sources, but easeof-use and supposedly good memorability seem to outweigh this drawback for some applications. Recently, a database dump of an online dating website was leaked, including 3.9 million plain text answers to personal knowledge questions, making it the largest publicly available list. We analyzed this list of answers and were able to confirm previous findings that were obtained from non-public lists (WWW 2015), in particular, we found that some users don't answer truthfully, which may actually reduce the answer's entropy.
International Conference on Passwords (PASSWORDS)
2015-12-07
2026-04-01