
No shared knowledge for secret questions
-------

**Description:**

Whenever an application ask an user a secret question such as for i.e a password forgot 
functionality, these questions should not be shared knowledge an attacker could get from 
the web to prevent him compromising the account by this function.


**Solution:**

Secret questions should never include shared knowledge, predictable or easy
guessable values.

	