1. A method of generating knowledge-based authentication (KBA) questions, the method comprising: obtaining, from a user device, an activity log of a user, the activity log including pointers to a set of external fact sources; deriving external facts from each external fact source of the set of external fact sources; and generating a set of KBA questions from the external facts; wherein the activity log of the user includes a web browsing history of the user, wherein the pointers to the set of external fact sources include a list of addresses, within the web browsing history, of websites corresponding to the respective addresses and previously visited by the user, the set of external fact sources including the websites addressed by the list of addresses, wherein deriving the set of external facts includes accessing, over a network, each of the websites addressed by the list of addresses and acquiring the external facts from the websites, and wherein the KBA questions are generated by a KBA server from content of websites distinct from the user device, pointed to by the web browsing history on the user device, and visited by the KBA server connecting to the websites over the network.