Question based user authentication in commercial environments

The aim of this paper is to analyze question based user authentication methods with regard to their potential use in commercial environments and the limitations they impose. We provide an overview of current work related to question based authentication and describe the difference between static and dynamic questions in user authentication. Additionally, we give an introduction into some common practices used in user authentication in commercial environments. Based on existing research we suggest that only dynamic questions should be used in commercial environments and propose a set of requirements a data source used for creating authentication challenges should meet. Also, we categorize the types of data that can be leveraged for authenticating users.