Designing and evaluating challenge-question systems
Mike Just · IEEE Security & Privacy · 2004
The author describes a framework for designing user authentication systems with challenge questions that includes privacy, security, and usability criteria for evaluating a candidate challenge-question system. The proposed challenge-question system for recovering user credentials is based on this framework.