Knowledge-Based Authentication using Twitter Can We Use Lunch Menus As Passwords?

The vast majority of online servicesrequire some form ofpersonal authentication. Unfortunately, standard password authentication strikes a poor balance between security and convenience, whereas strongerauthentication schemes,such as those involvingbiometrics, one-time passwords, and electronic certificates, depend on specialized hardware and/orhardware tokens. To achieve convenience, robustness,and cost-effectiveness together, we propose a scheme for dynamicknowledge-based authentication in which Twitter direct messaging is used to collectsimple, memorable question/answer pairs. We also conduct a user study to evaluate the proposed scheme