Glossary
Knowledge-Based Authentication
Knowledge-based authentication verifies a person by asking something only they should know: a security question, a childhood detail, an account number. It was a common fallback for account recovery and identity proofing, on the assumption that this information is private to the individual.
The weakness is that much of this information isn't actually private — it's discoverable through public records, social media, or data broadly leaked in unrelated breaches, which means the security question is often guessable or researchable by anyone motivated enough to try. Modern identity proofing has largely moved toward evidence that's harder to look up, such as documentary verification, rather than knowledge alone.