It's No Secret. Measuring the Security and Reliability of Authentication via "Secret" Questions.

Stuart E. Schechter, A. J. Bernheim Brush, Serge Egelman

Browse the full SP paper archive.